CVE-2023-43642

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Sep 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-436436.1AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a CVE-2023-436449.8Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent CVE-2023-436455.9OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of ser CVE-2023-436467.5get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 ar CVE-2023-436475.4baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload featur CVE-2023-436486.5baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission dat CVE-2023-436499.8baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content prev CVE-2023-43654.3Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a CVE-2023-436507.4JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to t CVE-2023-436519.9JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary comman CVE-2023-436529.1JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an CVE-2023-436549.8TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, e