{"id":"CVE-2023-3635","aliases":["CLSA-2025-1750809965","CLSA-2025-1763597219","CLSA-2026-1793136530","CLSA-2026-1793136683","CLSA-2026-1793136790","EUVD-2023-2158","GHSA-w33c-445m-f8w7","RHLW-2026-61325e90a4894c88","RHLW-2026-9031fc90e5b99bd1","RHLW-2026-e708cf2111a96b61","UBUNTU-CVE-2023-3635"],"status":"published","title":"Okio GzipSource unhandled exception Denial of Service","description":"GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01254,"percentile":0.69865,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-195","CWE-681"],"published":"2023-07-12T18:34:31Z","modified":"2026-11-02T19:46:32Z","exploits":[{"source":"pocgithub","id":"JoshuaASmith/reproducer-okio-cve-2023-3635","title":"JoshuaASmith/reproducer-okio-cve-2023-3635","date":"2026-08-25","url":"https://github.com/JoshuaASmith/reproducer-okio-cve-2023-3635"}],"fixes":[{"ecosystem":"Maven","package":"com.squareup.okio:okio","fixed_in":["3.4.0","1.17.6"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.squareup.okio:okio-jvm","fixed_in":["3.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.squareup.okio:okio","fixed_in":["2.8.0.tuxcare.1","2.10.0-tuxcare.1","1.4.0-tuxcare.1","1.14.0-tuxcare.1","1.6.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"com.squareup.okio:okio","fixed_in":["1.17.2.rhlw-00001","3.0.0.rhlw-00004","1.6.0.rhlw-00001"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-RC1"},{"fixed":"3.4.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.squareup.okio:okio-jvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-RC1"},{"fixed":"3.4.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.0.tuxcare.1"}]}],"versions":["2.8.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.0-tuxcare.1"}]}],"versions":["2.10.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.0-tuxcare.1"}]}],"versions":["1.4.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.0-tuxcare.1"}]}],"versions":["1.14.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.0-tuxcare.1"}]}],"versions":["1.6.0"]},{"source":"osv","ecosystem":"Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-RC1"},{"fixed":"3.4.0"}]}],"versions":["2.0.0","2.0.0-RC1","2.1.0","2.10.0","2.2.0","2.2.1","2.2.2","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.6.0","2.7.0","2.7.0-alpha.lockfree.1","2.7.0-alpha.lockfree.2","2.8.0","2.9.0","3.0.0","3.0.0-alpha.1","3.0.0-alpha.10","3.0.0-alpha.11","3.0.0-alpha.2","3.0.0-alpha.3","3.0.0-alpha.4","3.0.0-alpha.5","3.0.0-alpha.6","3.0.0-alpha.7","3.0.0-alpha.8","3.0.0-alpha.9","3.1.0","3.2.0","3.3.0"]},{"source":"osv","ecosystem":"Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6"}]}],"versions":["0.5.0","0.6.0","0.6.1","0.7.0","0.8.0","0.9.0","1.0.0","1.0.1","1.1.0","1.10.0","1.11.0","1.12.0","1.13.0","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.17.1","1.17.2","1.17.3","1.17.4","1.17.5","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0"]},{"source":"osv","ecosystem":"Maven","package":"com.squareup.okio:okio-jvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-RC1"},{"fixed":"3.4.0"}]}],"versions":["3.0.0","3.0.0-alpha.10","3.0.0-alpha.11","3.1.0","3.2.0","3.3.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.2"},{"fixed":"1.17.2.rhlw-00001"}]}],"versions":["1.17.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.0.rhlw-00004"}]}],"versions":["3.0.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.squareup.okio:okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0.rhlw-00001"}]}],"versions":["0.5.0","0.6.0","0.6.1","0.7.0","0.8.0","0.9.0","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-2","1.13.0-1","1.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"okio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-2","1.16.0-2build1"]}],"products":[{"vendor":"squareup","product":"okio"}],"references":[{"url":"https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195/","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web","report"]},{"url":"https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3635","tags":["advisory"]},{"url":"https://github.com/square/okio/pull/1280","tags":["web"]},{"url":"https://github.com/square/okio/pull/1334","tags":["web"]},{"url":"https://github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839","tags":["web"]},{"url":"https://github.com/square/okio/blob/master/CHANGELOG.md#version-1176","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w33c-445m-f8w7","tags":["advisory"]},{"url":"https://mvnrepository.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3635.json","tags":["advisory"]},{"url":"https://github.com/square/okio","tags":["package"]},{"url":"https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-3635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3635","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-3635","title":"Okio GzipSource unhandled exception Denial of Service","description":"GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.\n\n","status":"published","published":"2023-07-12T18:34:31.609Z","modified":"2024-10-23T13:32:52.994Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-195"],"updated_at":"2026-11-02T14:35:24.360381Z"}],"euvd":[{"id":"EUVD-2023-2158","description":"GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.\n\n","status":"published","published":"2023-07-12T18:34:31Z","modified":"2024-10-23T13:32:52Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:05:21.424716Z"}],"ghsa":[{"id":"GHSA-w33c-445m-f8w7","title":"Okio Signed to Unsigned Conversion Error vulnerability","description":"GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.\n\n","status":"published","published":"2023-07-12T21:30:50Z","modified":"2023-11-27T22:23:27Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-195","CWE-681"],"updated_at":"2026-11-02T14:37:22.840002Z"}],"nvd":[{"id":"CVE-2023-3635","description":"GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.\n\n","status":"published","published":"2023-07-12T19:15:08.983Z","modified":"2026-06-17T06:14:30.757Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-195","CWE-681"],"updated_at":"2026-11-02T14:08:15.91037Z"}],"osv":[{"id":"CVE-2023-3635","title":"Okio GzipSource unhandled exception Denial of Service","description":"GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.\n\n","status":"published","published":"2023-07-12T18:34:31.609Z","modified":"2026-10-28T02:30:25.697891723Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-195"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"GHSA-w33c-445m-f8w7","title":"Okio Signed to Unsigned Conversion Error vulnerability","description":"GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.\n\n","status":"published","published":"2023-07-12T21:30:50Z","modified":"2026-09-10T03:49:54.860062065Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-195","CWE-681"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"RHLW-2026-61325e90a4894c88","title":"Lightwell Security Advisory: okio 1.17.2.rhlw-00001","description":"Red Hat Lightwell has released com.squareup.okio:okio 1.17.2.rhlw-00001 with a backported security fix.\n\nCVE-2023-3635: Okio GzipSource unhandled exception Denial of Service\n\nThis patched artifact is a drop-in replacement for com.squareup.okio:okio 1.17.2 from Maven Central.","status":"published","published":"2026-10-08T19:45:15Z","modified":"2026-10-29T14:30:07.210697995Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-9031fc90e5b99bd1","title":"Lightwell Security Advisory: okio 3.0.0.rhlw-00004","description":"Red Hat Lightwell has released com.squareup.okio:okio 3.0.0.rhlw-00004 with a backported security fix.\n\nCVE-2023-3635: Okio GzipSource unhandled exception Denial of Service\n\nThis patched artifact is a drop-in replacement for com.squareup.okio:okio 3.0.0 from Maven Central.","status":"published","published":"2026-10-15T19:09:37Z","modified":"2026-10-29T14:30:04.329655168Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-e708cf2111a96b61","title":"Lightwell Security Advisory: okio 1.6.0.rhlw-00001","description":"Red Hat Lightwell has released com.squareup.okio:okio 1.6.0.rhlw-00001 with a backported security fix.\n\nCVE-2023-3635: Okio GzipSource unhandled exception Denial of Service\n\nThis patched artifact is a drop-in replacement for com.squareup.okio:okio 1.6.0 from Maven Central.","status":"published","published":"2026-10-12T16:53:50Z","modified":"2026-10-27T04:00:19.628601134Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"UBUNTU-CVE-2023-3635","description":"GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.","status":"published","published":"2023-07-12T19:15:00Z","modified":"2026-10-17T12:56:23.347202709Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"CLSA-2025-1750809965","title":"TuxCare security update for com.squareup.okio:okio (1 CVE)","description":"TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 2.8.0.tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-30T19:45:09.369461695Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1763597219","title":"TuxCare security update for com.squareup.okio:okio (1 CVE)","description":"TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 2.10.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-10-30T19:45:06.566633502Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1793136530","title":"TuxCare security update for com.squareup.okio:okio (1 CVE)","description":"TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 1.4.0-tuxcare.1.","status":"published","published":"2026-10-27T21:28:50Z","modified":"2026-11-02T19:46:32.562106887Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793136683","title":"TuxCare security update for com.squareup.okio:okio (1 CVE)","description":"TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 1.14.0-tuxcare.1.","status":"published","published":"2026-10-27T21:31:23Z","modified":"2026-11-02T19:46:32.493458605Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793136790","title":"TuxCare security update for com.squareup.okio:okio (1 CVE)","description":"TuxCare rebuilt com.squareup.okio:okio to address 1 CVE. Fixed in 1.6.0-tuxcare.1.","status":"published","published":"2026-10-27T21:33:10Z","modified":"2026-11-02T19:46:32.589644567Z","updated_at":"2026-11-02T20:28:42.34712Z"}]}}