CVE-2023-43642 Missing upper bound check on chunk length in snappy-java
Attackers can cause denial of service in applications using snappy-java by providing compressed data with excessively large chunk sizes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-43642?
CVE-2023-43642 is a high-severity denial of service vulnerability in xerial snappy-java, published on 25 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.
Weakness: CWE-770
Which versions are affected by CVE-2023-43642?
2 open source packages ship an affected version, including org.xerial.snappy:snappy-java. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.xerial.snappy:snappy-java Maven | All versions | 1.1.10.4 |
org.xerial.snappy:snappy-java Maven | All versions | 1.1.10.4 |
Products include Xerial Snappy-Java.
How do I fix CVE-2023-43642?
Upgrade org.xerial.snappy:snappy-java to 1.1.10.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-43642 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-43642 exists.
Other vulnerabilities in xerial snappy-java
Sources
Also known as CLEANSTART-2026-HS17882, CLEANSTART-2026-TL41990, CLSA-2026-1777250302, DEBIAN-CVE-2023-43642, ECHO-36e1-902e-4338, GHSA-55g7-9cwv-5qfv and 3 more.