CVE-2023-3635
Okio GzipSource unhandled exception Denial of Service
CVE-2023-3635 is a medium vulnerability (CVSS 5.9) in Squareup Okio, published July 12, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in com.squareup.okio:okio 3.4.0.
- Severity
- 5.9 MediumCVSS 3.1, CVE List
- Exploit chance
- 1.25%EPSS, 69th percentile
- Exploitation
- None known1 public exploit
- Fixed in
3.4.0com.squareup.okio:okio +20 more
Description
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.squareup.okio:okioMaven | 2.0.0-RC1 up to 3.4.0 | 3.4.0 |
com.squareup.okio:okioMaven | before 1.17.6 | 1.17.6 |
com.squareup.okio:okio-jvmMaven | 2.0.0-RC1 up to 3.4.0 | 3.4.0 |
com.squareup.okio:okioTuxCare:Maven | 2.8.0 up to 2.8.0.tuxcare.1 | 2.8.0.tuxcare.1 |
com.squareup.okio:okioTuxCare:Maven | 2.10.0 up to 2.10.0-tuxcare.1 | 2.10.0-tuxcare.1 |
com.squareup.okio:okioTuxCare:Maven | 1.4.0 up to 1.4.0-tuxcare.1 | 1.4.0-tuxcare.1 |
com.squareup.okio:okioTuxCare:Maven | 1.14.0 up to 1.14.0-tuxcare.1 | 1.14.0-tuxcare.1 |
com.squareup.okio:okioTuxCare:Maven | 1.6.0 up to 1.6.0-tuxcare.1 | 1.6.0-tuxcare.1 |
com.squareup.okio:okioMaven | 2.0.0-RC1 up to 3.4.0, plus listed versions 2.0.02.1.02.10.02.2.02.2.1 Show 28 moreShow less2.2.22.3.02.4.02.4.12.4.22.4.32.5.02.6.02.7.02.7.0-alpha.lockfree.12.7.0-alpha.lockfree.22.8.02.9.03.0.03.0.0-alpha.13.0.0-alpha.103.0.0-alpha.113.0.0-alpha.23.0.0-alpha.33.0.0-alpha.43.0.0-alpha.53.0.0-alpha.63.0.0-alpha.73.0.0-alpha.83.0.0-alpha.93.1.03.2.03.3.0 | 3.4.0 |
com.squareup.okio:okioMaven | before 1.17.6, plus listed versions 0.5.00.6.00.6.10.7.00.8.0 Show 26 moreShow less0.9.01.0.01.0.11.1.01.10.01.11.01.12.01.13.01.14.01.14.11.15.01.16.01.17.01.17.11.17.21.17.31.17.41.17.51.2.01.3.01.4.01.5.01.6.01.7.01.8.01.9.0 | 1.17.6 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.squareup.okio:okio-jvmMaven | 2.0.0-RC1 up to 3.4.0, plus listed versions 3.0.03.0.0-alpha.103.0.0-alpha.113.1.03.2.03.3.0 | 3.4.0 |
com.squareup.okio:okioRed Hat Lightwell:Maven | 1.17.2 up to 1.17.2.rhlw-00001 | 1.17.2.rhlw-00001 |
com.squareup.okio:okioRed Hat Lightwell:Maven | 3.0.0 up to 3.0.0.rhlw-00004 | 3.0.0.rhlw-00004 |
com.squareup.okio:okioRed Hat Lightwell:Maven | before 1.6.0.rhlw-00001, plus listed versions 0.5.00.6.00.6.10.7.00.8.0 Show 9 moreShow less0.9.01.0.01.0.11.1.01.2.01.3.01.4.01.5.01.6.0 | 1.6.0.rhlw-00001 |
okioUbuntu:18.04:LTS | All versions, plus listed versions 1.8.0-21.13.0-11.14.0-1 | None known |
okioUbuntu:20.04:LTS | All versions, plus listed versions 1.16.0-1 | None known |
okioUbuntu:22.04:LTS | All versions, plus listed versions 1.16.0-2 | None known |
okioUbuntu:24.04:LTS | All versions, plus listed versions 1.16.0-2 | None known |
okioUbuntu:25.10 | All versions, plus listed versions 1.16.0-2 | None known |
okioUbuntu:26.10 | All versions, plus listed versions 1.16.0-2build1 | None known |
okioUbuntu:26.04:LTS | All versions, plus listed versions 1.16.0-21.16.0-2build1 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | JoshuaASmith/reproducer-okio-cve-2023-3635 | 2026-08-25 |
What each source reports
CVE List Score used
Okio GzipSource unhandled exception Denial of Service
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
- Record
CVE-2023-3635- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-195
- Updated
- 2026-11-02
EUVDEUVD-2023-2158
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
- Record
EUVD-2023-2158- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w33c-445m-f8w7
Okio Signed to Unsigned Conversion Error vulnerability
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
- Record
GHSA-w33c-445m-f8w7- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-195, CWE-681
- Updated
- 2026-11-02
NVD
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
- Record
CVE-2023-3635- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-195, CWE-681
- Updated
- 2026-11-02
OSV
Okio GzipSource unhandled exception Denial of Service
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
- Record
CVE-2023-3635- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-195
- Updated
- 2026-11-02
OSVGHSA-w33c-445m-f8w7
Okio Signed to Unsigned Conversion Error vulnerability
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
- Record
GHSA-w33c-445m-f8w7- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-195, CWE-681
- Updated
- 2026-11-02
Show 9 moreShow less
OSVRHLW-2026-61325e90a4894c88
Lightwell Security Advisory: okio 1.17.2.rhlw-00001
Red Hat Lightwell has released com.squareup.okio:okio 1.17.2.rhlw-00001 with a backported security fix.
CVE-2023-3635: Okio GzipSource unhandled exception Denial of Service
This patched artifact is a drop-in replacement for com.squareup.okio:okio 1.17.2 from Maven Central.
- Record
RHLW-2026-61325e90a4894c88- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-9031fc90e5b99bd1
Lightwell Security Advisory: okio 3.0.0.rhlw-00004
Red Hat Lightwell has released com.squareup.okio:okio 3.0.0.rhlw-00004 with a backported security fix.
CVE-2023-3635: Okio GzipSource unhandled exception Denial of Service
This patched artifact is a drop-in replacement for com.squareup.okio:okio 3.0.0 from Maven Central.
- Record
RHLW-2026-9031fc90e5b99bd1- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-e708cf2111a96b61
Lightwell Security Advisory: okio 1.6.0.rhlw-00001
Red Hat Lightwell has released com.squareup.okio:okio 1.6.0.rhlw-00001 with a backported security fix.
CVE-2023-3635: Okio GzipSource unhandled exception Denial of Service
This patched artifact is a drop-in replacement for com.squareup.okio:okio 1.6.0 from Maven Central.
- Record
RHLW-2026-e708cf2111a96b61- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-3635
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
- Record
UBUNTU-CVE-2023-3635- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1750809965No score
TuxCare security update for com.squareup.okio:okio (1 CVE)
TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 2.8.0.tuxcare.1.
- Record
CLSA-2025-1750809965- Updated
- 2026-11-02
OSVCLSA-2025-1763597219No score
TuxCare security update for com.squareup.okio:okio (1 CVE)
TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 2.10.0-tuxcare.1.
- Record
CLSA-2025-1763597219- Updated
- 2026-11-02
OSVCLSA-2026-1793136530No score
TuxCare security update for com.squareup.okio:okio (1 CVE)
TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 1.4.0-tuxcare.1.
- Record
CLSA-2026-1793136530- Updated
- 2026-11-02
OSVCLSA-2026-1793136683No score
TuxCare security update for com.squareup.okio:okio (1 CVE)
TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 1.14.0-tuxcare.1.
- Record
CLSA-2026-1793136683- Updated
- 2026-11-02
OSVCLSA-2026-1793136790No score
TuxCare security update for com.squareup.okio:okio (1 CVE)
TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 1.6.0-tuxcare.1.
- Record
CLSA-2026-1793136790- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195
github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b
nvd.nist.gov/vuln/detail/CVE-2023-3635