CVE-2023-22895
bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
- Record
CVE-2023-22895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
- Record
CVE-2023-22895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2023-0424
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
- Record
EUVD-2023-0424- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-96jv-r488-c2rj
bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
- Record
GHSA-96jv-r488-c2rj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
- Record
CVE-2023-22895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-22895
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
- Record
DEBIAN-CVE-2023-22895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-96jv-r488-c2rj
bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
- Record
GHSA-96jv-r488-c2rj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-22895
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
- Record
UBUNTU-CVE-2023-22895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12610-1 No score
rage-encryption-0.9.0+0-4.1 on GA media
These are all security issues fixed in the rage-encryption-0.9.0+0-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12610-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12614-1 No score
python310-cramjam-2.6.2-1.1 on GA media
These are all security issues fixed in the python310-cramjam-2.6.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12614-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12616-1 No score
wasm-pack-0.10.3~0-2.1 on GA media
These are all security issues fixed in the wasm-pack-0.10.3~0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12616-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15094-1 No score
python311-cramjam-2.9.1-1.3 on GA media
These are all security issues fixed in the python311-cramjam-2.9.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15094-1- Updated
- 2026-11-02
OSVRUSTSEC-2023-0004 No score
bzip2 Denial of Service (DoS)
Working with specific payloads can cause a Denial of Service (DoS) vector.
Both Decompress and Compress implementations can enter into infinite loops
given specific payloads entered that trigger it.
The issue is described in great detail in the bzip2 repository issue.
Thanks to bjrjk for finding and providing the patch for the issue and the maintainer responsibly responding to release a fix quickly.
Users who use the crate with untrusted data should update the bzip2 to 0.4.4.
- Record
RUSTSEC-2023-0004- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bzip2crates.io |
before 0.4.4 | 0.4.4 |
rust-bzip2Debian:12 |
before 0.4.4-1 | 0.4.4-1 |
rust-bzip2Debian:13 |
before 0.4.4-1 | 0.4.4-1 |
rust-bzip2Debian:14 |
before 0.4.4-1 | 0.4.4-1 |
bzip2crates.io |
0.0.0-0 up to 0.4.4 | 0.4.4 |
rust-bzip2Ubuntu:20.04:LTS |
All versions, plus listed versions 0.3.3-1 |
None known |
rust-bzip2Ubuntu:22.04:LTS |
All versions, plus listed versions 0.4.1-10.4.1-2 |
None known |
rust-bzip2Ubuntu:24.04:LTS |
All versions, plus listed versions 0.4.4-1 |
None known |
rust-bzip2Ubuntu:25.10 |
All versions, plus listed versions 0.4.4-1 |
None known |
rust-bzip2Ubuntu:26.10 |
All versions, plus listed versions 0.6.1-1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rust-bzip2Ubuntu:26.04:LTS |
All versions, plus listed versions 0.4.4-10.6.1-1 |
None known |
rage-encryptionopenSUSE:Tumbleweed |
before 0.9.0+0-4.1 | 0.9.0+0-4.1 |
wasm-packopenSUSE:Tumbleweed |
before 0.10.3~0-2.1 | 0.10.3~0-2.1 |
python-cramjamopenSUSE:Tumbleweed |
before 2.9.1-1.3 | 2.9.1-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-22895 is a high vulnerability (CVSS 7.5) in Bzip2 Project Bzip2, published January 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in bzip2 0.4.4.
References
github.com/alexcrichton/bzip2-rs/pull/86
crates.io/crates/bzip2/versions
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MI5SVRSGKBWB2JGDLDVIFY5ZQVDZP6I7
nvd.nist.gov/vuln/detail/CVE-2023-22895
Show 14 moreShow less
rustsec.org/advisories/RUSTSEC-2023-0004.html
security-tracker.debian.org/tracker/CVE-2023-22895
ubuntu.com/security/CVE-2023-22895
cve.org/CVERecord?id=CVE-2023-22895
suse.com/security/cve/CVE-2023-22895
lists.opensuse.org/archives/list/[email protected]/thread/CKLLTASOKTCALVLNRTUKQYYSBAFZ4KVU