PT-2023-8389 · Unknown+3 · Snappy-Java+4

Flabbergastedbd + 2 · Publicado 2023-09-25 · Atualizado 2026-05-18 · CVE-2023-43642

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions snappy-java versions 1.1.10.3 and earlier

Description The SnappyInputStream in snappy-java is vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size due to a missing upper bound check on chunk length, which can cause an unrecoverable fatal error. Users are advised to upgrade to a newer version. Users unable to upgrade should only accept compressed data from trusted sources.

Recommendations For versions 1.1.10.3 and earlier, upgrade to version 1.1.10.4 or later, which includes the fix introduced in commit 9f8c3cf74. As a temporary workaround, consider only accepting compressed data from trusted sources until a patch is available.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BDU:2024-00588

CLEANSTART-2026-DD05788

CLEANSTART-2026-VH41554

CVE-2023-43642

GHSA-55G7-9CWV-5QFV

OESA-2023-1700

Produtos afetados

Astra Linux

Bitbucket

Debian

Jira

Snappy-Java

Referências · 220

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43642.json · Exploit
• 🔥 https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv · Exploit
• https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5 · Correção
• https://github.com/xerial/snappy-java · Nota
• https://github.com/xerial/snappy-java/releases/tag/v1.1.10.4 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DD05788.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VH41554.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-34454 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-52428 · Nota
• https://osv.dev/vulnerability/ghsa-fghv-69vj-qj49 · Nota
• https://osv.dev/vulnerability/ghsa-xq3w-v528-46rv · Nota
• https://osv.dev/vulnerability/ghsa-493p-pfq6-5258 · Nota
• https://osv.dev/vulnerability/CVE-2026-42585 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-43642 · Nota de Segurança