PT-2023-8389 · Unknown+3 · Snappy-Java+4

Flabbergastedbd + 2 · Published 2023-09-25 · Updated 2026-05-18 · CVE-2023-43642

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions snappy-java versions 1.1.10.3 and earlier

Description The SnappyInputStream in snappy-java is vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size due to a missing upper bound check on chunk length, which can cause an unrecoverable fatal error. Users are advised to upgrade to a newer version. Users unable to upgrade should only accept compressed data from trusted sources.

Recommendations For versions 1.1.10.3 and earlier, upgrade to version 1.1.10.4 or later, which includes the fix introduced in commit 9f8c3cf74. As a temporary workaround, consider only accepting compressed data from trusted sources until a patch is available.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2024-00588

CLEANSTART-2026-DD05788

CLEANSTART-2026-VH41554

CVE-2023-43642

GHSA-55G7-9CWV-5QFV

OESA-2023-1700

Affected Products

Astra Linux

Bitbucket

Debian

Jira

Snappy-Java

References · 220

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43642.json · Exploit
• 🔥 https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv · Exploit
• https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-34454 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43642 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-12801 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55163 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42587 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-67735 · Security Note