CVE-2023-34453 snappy-java's Integer Overflow vulnerability in shuffle leads to DoS
An integer overflow in snappy-java's shuffle function can cause application crashes via exceptions, requiring an upgrade to the patched version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34453?
CVE-2023-34453 is a medium-severity vulnerability in xerial snappy-java, published on 15 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error.
The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a `java.lang.NegativeArraySizeException` exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as `java.lang.ArrayIndexOutOfBoundsException`.
The same issue exists also when using the `shuffle` functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue.
Version 1.1.10.1 contains a patch for this vulnerability.
Weakness: CWE-190
Which versions are affected by CVE-2023-34453?
2 open source packages ship an affected version, including org.xerial.snappy:snappy-java. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.xerial.snappy:snappy-java Maven | All versions | 1.1.10.1 |
org.xerial.snappy:snappy-java Maven | All versions | 1.1.10.1 |
Products include Xerial Snappy-Java.
How do I fix CVE-2023-34453?
Upgrade org.xerial.snappy:snappy-java to 1.1.10.1 or later.
Is CVE-2023-34453 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34453 exists.
Other vulnerabilities in xerial snappy-java
Sources
Also known as CLEANSTART-2026-RW23866, CLEANSTART-2026-VS75149, ECHO-c9f0-de93-b7b8, GHSA-pqr6-cmr2-h8hf, UBUNTU-CVE-2023-34453.