CVE-2023-43642
highpriority · track · 30EPSS 0.012 · 68 %ileDEEUNLRUUSEPSS · scored 2026-10-26
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (84)
Products and version ranges known to be affected.
- communications_billing_and_revenue_managementall versionsncsc_nlNLcpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.0.0.0:*:*:*:*:*:*:*
- communications_cloud_native_core_automated_test_suiteall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:23.1.3:*:*:*:*:*:*:*
- communications_cloud_native_core_automated_test_suiteall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:23.3.0:*:*:*:*:*:*:*
- communications_cloud_native_core_automated_test_suiteall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:23.2.1:*:*:*:*:*:*:*
- communications_cloud_native_core_consoleall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_console:23.3.1:*:*:*:*:*:*:*
- communications_cloud_native_core_consoleall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_console:23.3.0:*:*:*:*:*:*:*
- communications_cloud_native_core_network_data_analytics_functionall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_network_data_analytics_function:23.3.0:*:*:*:*:*:*:*
- communications_cloud_native_core_network_data_analytics_functionall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_network_data_analytics_function:23.4.0:*:*:*:*:*:*:*
- communications_cloud_native_core_network_exposure_functionall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:23.3.1:*:*:*:*:*:*:*
- communications_cloud_native_core_network_function_cloud_native_environmentall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:23.3.1:*:*:*:*:*:*:*
- communications_cloud_native_core_network_function_cloud_native_environmentall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:23.2.0:*:*:*:*:*:*:*
- communications_cloud_native_core_network_function_cloud_native_environmentall versionsncsc_nlNLcpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:23.1.0:*:*:*:*:*:*:*
advisories (12)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0414Kwetsbaarheden verholpen in Oracle CommunicationsNL2024-10-17csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse Communications producten en systemen.
- WID-SEC-W-2023-2935IBM Integration Bus: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2023-11-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Integration Bus ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2023-3025IBM InfoSphere Information Server: Mehrere SchwachstellenDeutsch2023-11-28csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2023-3195Red Hat Quarkus: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2023-12-20csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Quarkus ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2024-0101Atlassian Bitbucket: Mehrere SchwachstellenDeutsch2024-01-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Atlassian Bitbucket ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder Request-Smuggling-Angriffe durchzuführen.
- WID-SEC-W-2024-0274IBM Maximo Asset Management: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-02-01csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM Maximo Asset Management ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2024-0277IBM Business Automation Workflow: Mehrere SchwachstellenDeutsch2024-02-01csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, einen Phishing-Angriff durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2024-0671Atlassian Jira Software: Mehrere Schwachstellen ermöglichen Codeausführung und DoSDeutsch2024-03-19csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in der Atlassian Jira Software ausnutzen, um beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2024-0794Dell ECS: Mehrere SchwachstellenDeutsch2024-04-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2024-3684IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2024-12-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder einen Spoofing-Angriff durchzuführen.
- WID-SEC-W-2025-0518IBM InfoSphere Data Replication: Mehrere SchwachstellenDeutsch2025-03-10csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Data Replication ausnutzen, um Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.
- GHSA-55g7-9cwv-5qfvsnappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact2023-09-25ghsa · osvUS
### Summary snappy-java is a data compression library in Java. Its SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too-large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. ### Scope All versions of snappy-java including the latest released version 1.1.10.3. A fix is applied in 1.1.10.4 ### Details While performing mitigation efforts related to [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) in Confluent products, our Application Security team closely analyzed the fix that was accepted and merged into snappy-java version 1.1.10.1 in [this](https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaea) commit. The check on [line 421](https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaea#diff-c3e53610267092989965e8c7dd2d4417d355ff7f560f9e8075b365f32569079fR421) only attempts to check if chunkSize is not a negative value. We believe that this is an inadequate fix as it misses an upper-bounds check for overly positive values such as 0x7FFFFFFF (or (2,147,483,647 in decimal) before actually [attempting to allocate](https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaea#diff-c3e53610267092989965e8c7dd2d4417d355ff7f560f9e8075b365f32569079fR429) the provided unverified number of bytes via the “chunkSize” variable. This missing upper-bounds check can lead to the applications depending upon snappy-java to allocate an inappropriate number of bytes on the heap which can then cause an java.lang.OutOfMemoryError exception. Under some specific conditions and contexts, this can lead to a Denial-of-Service (DoS) attack with a direct impact on the availability of the dependent implementations based on the usage of the snappy-java library for compression/decompression needs. ### PoC Compile and run the following code: ``` package org.example; import org.xerial.snappy.SnappyInputStream; import java.io.*; public class Main { public static void main(String[] args) throws IOException { byte[] data = {-126, 'S', 'N', 'A', 'P', 'P', 'Y', 0, 0, 0, 0, 0, 0, 0, 0, 0,(byte) 0x7f, (byte) 0xff, (byte) 0xff, (byte) 0xff}; SnappyInputStream in = new SnappyInputStream(new ByteArrayInputStream(data)); byte[] out = new byte[50]; try { in.read(out); } catch (Exception ignored) { } } } ``` ### Impact Denial of Service of applications dependent on snappy-java especially if `ExitOnOutOfMemoryError` or `CrashOnOutOfMemoryError` is configured on the JVM. ### Credits Jan Werner, Mukul Khullar and Bharadwaj Machiraju from Confluent's Application Security team. We kindly request for a new CVE ID to be assigned once you acknowledge this vulnerability.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-43642/cnnvd
- https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5cnnvd
- https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfvcnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.7226cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.7621cnnvd
- https://www.auscert.org.au/bulletins/ESB-2024.0712cnnvd
- https://www.oracle.com/security-alerts/cpujan2024.htmlcnnvd
- https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan