CVE-2023-43642 - CVE House

Back to Database

Status published High CVE-2023-43642

Missing upper bound check on chunk length in snappy-java

7.5 CVSS

Vulnerability Description

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-43642

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from xerial

View All →

snappy-java's unchecked chunk length leads to DoS

snappy-java's Integer Overflow vulnerability in compress leads to DoS

snappy-java's Integer Overflow vulnerability in shuffle leads to DoS

Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

Affected Vendor

xerial

View all reports →

Affected Software

snappy-java

Vulnerable Versions:

< 1.1.10.4

Timeline

Official Publish: September 25th, 2023

Last Modified: September 24th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery