CVE-2026-69702

CVE-2026-69702 is a Zstandard decompression bomb vulnerability in SnailJob's retry pipeline that causes an unrecoverable OutOfMemoryError. The bug lives in how the framework handles compressed task arguments when replaying failed jobs—and the 'authenticated attacker' qualifier in the CVE description significantly undersells the actual risk. The attack surface isn't a privileged deserialization endpoint. It's 'enqueue a task with custom arguments,' which in most SnailJob deployments means any valid API consumer: webhooks, scheduled jobs, CI/CD pipelines. You don't need to exploit a live deserialization path—you need to get the payload into the retry queue. Once there, it sits dormant through service restarts and maintenance windows until the retry fires, at which point the decompressed frame overwhelms heap allocation and crashes the JVM hosting the retry coordinator. This matters because OOME at the JVM level isn't a catchable application exception. It can corrupt in-memory state and leave the retry coordinator in an inconsistent state requiring full restart. You're not just losing one failed task—you potentially lose in-flight retry state for unrelated jobs and the coordination lock other instances may be waiting on. The deeper problem is architectural: SnailJob's core promise is 'your task will eventually execute,' which requires serializing everything and replaying it. That reliability design creates an implicit trust boundary that most deployments never consciously navigate. The fix in 1.7.1 addresses the Zstandard parsing bug, but the systemic issue is that retry pipelines worldwide are accumulating user-controlled state with compression that was never designed to receive untrusted input. Treat all compressed task arguments as untrusted regardless of how they entered the queue. If your deployment allows custom job arguments from any API consumer, prioritize this patch. The 'authenticated' label means 'has a valid API key,' not 'trusted insider'—that's a dramatically lower bar than it sounds.

Reviewed through automated stages and approved by a human before publication.