CVE-2023-3635 Okio GzipSource unhandled exception Denial of Service
An attacker can cause a denial of service in applications using Okio by providing a malformed GZIP archive that triggers an unhandled exception.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3635?
CVE-2023-3635 is a medium-severity denial of service vulnerability in squareup:okio, published on 12 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
Which versions are affected by CVE-2023-3635?
6 open source packages ship an affected version, including com.squareup.okio:okio and com.squareup.okio:okio-jvm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.squareup.okio:okio Maven | All versions | 1.17.6 |
com.squareup.okio:okio Maven | All versions | 1.17.6 |
com.squareup.okio:okio Maven | From 2.0.0-RC1 | 3.4.0 |
com.squareup.okio:okio Maven | From 2.0.0-RC1 | 3.4.0 |
com.squareup.okio:okio-jvm Maven | From 2.0.0-RC1 | 3.4.0 |
com.squareup.okio:okio-jvm Maven | From 2.0.0-RC1 | 3.4.0 |
Products include Squareup Okio.
How do I fix CVE-2023-3635?
Upgrade com.squareup.okio:okio to a fixed version for your release line: 1.17.6 or 3.4.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-3635 being exploited?
There is no known exploitation of CVE-2023-3635 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLEANSTART-2026-GW94479, CLEANSTART-2026-IJ91953, CLEANSTART-2026-RR66440, CLSA-2025-1750809965, CLSA-2025-1763597219, CLSA-2026-1793136530 and 8 more.