CVE-2023-43642

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Sep 25, 2023
Updated: Sep 26, 2023
CWE ID 770

Summary

CVE-2023-43642 is a vulnerability affecting snappy-java, a Java port of the snappy compresser/decompresser developed by Google. The SnappyInputStream in snappy-java is vulnerable to Denial of Service (DoS) attacks when decompressing data with a chunk size that is too large. This can lead to an unrecoverable fatal error. All versions of snappy-java, including the latest release 1.1.10.3, are affected by this issue. A fix has been introduced in commit `9f8c3cf74` and will be included in the upcoming release 1.1.10.4. To remediate this vulnerability, users are advised to upgrade to the patched version. If upgrading is not possible, it is recommended to only accept compressed data from trusted sources. This vulnerability has a high severity level and poses a potential danger to organizations as it can be exploited remotely over a network, leading to service disruption or denial of service attacks on affected systems.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future

Note: This is just a basic overview providing quick insights into CVE-2023-43642 information. Gain full access to comprehensive CVE data, third party vulnerabilities, compromised credentials and more with Recorded Future
  • Gain complete coverage of your cyber, third party, and physical attack surface
  • Proactively mitigate threats before they turn into costly attacks
  • Make fast, effective, data-driven decisions

Book your demo

Sign in

Back to Vulnerability Database