{"id":"CVE-2023-43642","aliases":["CLSA-2024-1732492826","CLSA-2026-1777250302","DEBIAN-CVE-2023-43642","EUVD-2023-2424","GHSA-55g7-9cwv-5qfv","OESA-2023-1700","ROOT-APP-MAVEN-CVE-2023-43642","UBUNTU-CVE-2023-43642"],"status":"published","title":"Missing upper bound check on chunk length in snappy-java","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01211,"percentile":0.68716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2023-09-25T18:30:18Z","modified":"2026-10-28T10:38:58Z","fixes":[{"ecosystem":"Maven","package":"org.xerial.snappy:snappy-java","fixed_in":["1.1.10.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.xerial.snappy:snappy-java","fixed_in":["1.1.2-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"snappy-java","fixed_in":["1.1.10.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"snappy-java","fixed_in":["1.1.10.5-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"snappy-java","fixed_in":["1.1.2.4-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"snappy-java","fixed_in":["1.1.2.4-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"snappy-java","fixed_in":["1.1.2.4-3.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"snappy-java","fixed_in":["1.1.2.4-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"snappy-java","fixed_in":["1.1.2.4-3.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.xerial.snappy:snappy-java","fixed_in":["1.1.10.1-root.io.1","1.1.10.1-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.xerial.snappy:snappy-java","fixed_in":["1.1.10.1-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xerial.snappy:snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.10.3"},{"fixed":"1.1.10.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.xerial.snappy:snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8.4"},{"fixed":"1.1.8.4.tuxcare"}]}],"versions":["1.1.8.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.xerial.snappy:snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.2"},{"fixed":"1.1.2-tuxcare.2"}]}],"versions":["1.1.2","1.1.2-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.10.5-1","1.1.10.5-2","1.1.10.7-1","1.1.10.8-1","1.1.8.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10.5-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.xerial.snappy:snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10.4"}]}],"versions":["1.0.1-rc1","1.0.1-rc2","1.0.1-rc3","1.0.1-rc4","1.0.3","1.0.3-rc1","1.0.3-rc2","1.0.3-rc3","1.0.3-rc4","1.0.3.1","1.0.3.2","1.0.3.3","1.0.4","1.0.4.1","1.0.5","1.0.5-M1","1.0.5-M2","1.0.5-M3","1.0.5-M4","1.0.5.1","1.0.5.2","1.0.5.3","1.0.5.4","1.1.0","1.1.0-M1","1.1.0-M2","1.1.0-M3","1.1.0-M4","1.1.0.1","1.1.1","1.1.1-M1","1.1.1-M2","1.1.1-M3","1.1.1-M4","1.1.1.1","1.1.1.2","1.1.1.3","1.1.1.4","1.1.1.5","1.1.1.6","1.1.1.7","1.1.10.0","1.1.10.1","1.1.10.2","1.1.10.3","1.1.2","1.1.2-M1","1.1.2-RC1","1.1.2-RC2","1.1.2-RC3","1.1.2.1","1.1.2.2","1.1.2.3","1.1.2.4","1.1.2.5","1.1.2.6","1.1.3-M1","1.1.3-M2","1.1.4","1.1.4-M1","1.1.4-M2","1.1.4-M3","1.1.7","1.1.7.1","1.1.7.2","1.1.7.3","1.1.7.4","1.1.7.5","1.1.7.6","1.1.7.7","1.1.7.8","1.1.8","1.1.8.1","1.1.8.2","1.1.8.3","1.1.8.4","1.1.9.0","1.1.9.1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2.4-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2.4-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2.4-3.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2.4-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2.4-3.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.xerial.snappy:snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10.1-root.io.1"},{"fixed":"1.1.10.1-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.xerial.snappy:snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10.1-aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.4.1~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1.7-2","1.1.2-1","1.1.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.4-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.7.2-1","1.1.7.3-1","1.1.7.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8.3-1","1.1.10.5-1","1.1.10.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.10.8-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"snappy-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.10.7-1","1.1.10.8-1"]}],"products":[{"vendor":"xerial","product":"snappy-java"}],"references":[{"url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv","tags":["x_refsource_CONFIRM","x_transferred","Exploit","advisory","web","report"]},{"url":"https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/xerial/snappy-java/releases/tag/v1.1.10.4","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43642","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-55g7-9cwv-5qfv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43642.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-43642","tags":["advisory"]},{"url":"https://github.com/xerial/snappy-java","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1700","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-43642","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43642","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-43642","title":"Missing upper bound check on chunk length in snappy-java ","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.","status":"published","published":"2023-09-25T19:03:49.145Z","modified":"2024-09-24T15:26:53.851Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:14.633899Z"}],"euvd":[{"id":"EUVD-2023-2424","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.","status":"published","published":"2023-09-25T19:03:49Z","modified":"2024-09-24T15:26:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:15.73715Z"}],"ghsa":[{"id":"GHSA-55g7-9cwv-5qfv","title":"snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact","description":"### Summary\n\nsnappy-java is a data compression library in Java. Its SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too-large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. \n\n### Scope\n\nAll versions of snappy-java including the latest released version 1.1.10.3.  A fix is applied in 1.1.10.4\n\n### Details\nWhile performing mitigation efforts related to [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) in Confluent products, our Application Security team closely analyzed the fix that was accepted and merged into snappy-java version 1.1.10.1 in [this](https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaea) commit. The check on [line 421](https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaea#diff-c3e53610267092989965e8c7dd2d4417d355ff7f560f9e8075b365f32569079fR421) only attempts to check if chunkSize is not a negative value. We believe that this is an inadequate fix as it misses an upper-bounds check for overly positive values such as 0x7FFFFFFF (or (2,147,483,647 in decimal) before actually [attempting to allocate](https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaea#diff-c3e53610267092989965e8c7dd2d4417d355ff7f560f9e8075b365f32569079fR429) the provided unverified number of bytes via the “chunkSize” variable. This missing upper-bounds check can lead to the applications depending upon snappy-java to allocate an inappropriate number of bytes on the heap which can then cause an  java.lang.OutOfMemoryError exception. Under some specific conditions and contexts, this can lead to a Denial-of-Service (DoS) attack with a direct impact on the availability of the dependent implementations based on the usage of the snappy-java library for compression/decompression needs.\n\n### PoC\nCompile and run the following code:\n```\npackage org.example;\nimport org.xerial.snappy.SnappyInputStream;\n\nimport java.io.*;\n\npublic class Main {\n\n    public static void main(String[] args) throws IOException {\n        byte[] data = {-126, 'S', 'N', 'A', 'P', 'P', 'Y', 0, 0, 0, 0, 0, 0, 0, 0, 0,(byte) 0x7f, (byte) 0xff, (byte) 0xff, (byte) 0xff};\n        SnappyInputStream in = new SnappyInputStream(new ByteArrayInputStream(data));\n        byte[] out = new byte[50];\n        try {\n            in.read(out);\n        }\n        catch (Exception ignored) {\n        }\n    }\n}\n```\n\n### Impact\nDenial of Service of applications dependent on snappy-java especially if `ExitOnOutOfMemoryError` or `CrashOnOutOfMemoryError` is configured on the JVM.\n\n### Credits\nJan Werner, Mukul Khullar and Bharadwaj Machiraju from Confluent's Application Security team. \n\nWe kindly request for a new CVE ID to be assigned once you acknowledge this vulnerability.","status":"published","published":"2023-09-25T18:30:18Z","modified":"2023-11-07T05:05:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:37:15.931647Z"}],"nvd":[{"id":"CVE-2023-43642","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.","status":"published","published":"2023-09-25T20:15:11.723Z","modified":"2026-06-17T06:26:08.227Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"CVE-2023-43642","title":"Missing upper bound check on chunk length in snappy-java ","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.","status":"published","published":"2023-09-25T19:03:49.145Z","modified":"2026-11-11T13:28:46.203589824Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2023-43642","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.","status":"published","published":"2023-09-25T20:15:11.723Z","modified":"2026-10-26T18:03:07.102184221Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-55g7-9cwv-5qfv","title":"snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact","description":"### Summary\n\nsnappy-java is a data compression library in Java. Its SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too-large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. \n\n### Scope\n\nAll versions of snappy-java including the latest released version 1.1.10.3.  A fix is applied in 1.1.10.4\n\n### Details\nWhile performing mitigation efforts related to [CVE-2023-34455](https://nvd.nist.gov/vuln/detail/CVE-2023-34455) in Confluent products, our Application Security team closely analyzed the fix that was accepted and merged into snappy-java version 1.1.10.1 in [this](https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaea) commit. The check on [line 421](https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaea#diff-c3e53610267092989965e8c7dd2d4417d355ff7f560f9e8075b365f32569079fR421) only attempts to check if chunkSize is not a negative value. We believe that this is an inadequate fix as it misses an upper-bounds check for overly positive values such as 0x7FFFFFFF (or (2,147,483,647 in decimal) before actually [attempting to allocate](https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaea#diff-c3e53610267092989965e8c7dd2d4417d355ff7f560f9e8075b365f32569079fR429) the provided unverified number of bytes via the “chunkSize” variable. This missing upper-bounds check can lead to the applications depending upon snappy-java to allocate an inappropriate number of bytes on the heap which can then cause an  java.lang.OutOfMemoryError exception. Under some specific conditions and contexts, this can lead to a Denial-of-Service (DoS) attack with a direct impact on the availability of the dependent implementations based on the usage of the snappy-java library for compression/decompression needs.\n\n### PoC\nCompile and run the following code:\n```\npackage org.example;\nimport org.xerial.snappy.SnappyInputStream;\n\nimport java.io.*;\n\npublic class Main {\n\n    public static void main(String[] args) throws IOException {\n        byte[] data = {-126, 'S', 'N', 'A', 'P', 'P', 'Y', 0, 0, 0, 0, 0, 0, 0, 0, 0,(byte) 0x7f, (byte) 0xff, (byte) 0xff, (byte) 0xff};\n        SnappyInputStream in = new SnappyInputStream(new ByteArrayInputStream(data));\n        byte[] out = new byte[50];\n        try {\n            in.read(out);\n        }\n        catch (Exception ignored) {\n        }\n    }\n}\n```\n\n### Impact\nDenial of Service of applications dependent on snappy-java especially if `ExitOnOutOfMemoryError` or `CrashOnOutOfMemoryError` is configured on the JVM.\n\n### Credits\nJan Werner, Mukul Khullar and Bharadwaj Machiraju from Confluent's Application Security team. \n\nWe kindly request for a new CVE ID to be assigned once you acknowledge this vulnerability.","status":"published","published":"2023-09-25T18:30:18Z","modified":"2026-09-10T03:49:57.806661468Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"OESA-2023-1700","title":"snappy-java security update","description":"A Java port of the snappy, a fast compresser/decompresser written in C++.\r\n\r\nSecurity Fix(es):\r\n\r\nsnappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.(CVE-2023-43642)","status":"published","published":"2023-09-28T11:06:09Z","modified":"2026-08-18T01:17:53.811164561Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"ROOT-APP-MAVEN-CVE-2023-43642","title":"CVE-2023-43642 in io.root.org.xerial.snappy:snappy-java - Patched by Root","description":"Root has patched CVE-2023-43642 in the io.root.org.xerial.snappy:snappy-java package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-18T10:30:51Z","modified":"2026-06-18T13:45:13.65206318Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2023-43642","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.","status":"published","published":"2023-09-25T20:15:00Z","modified":"2026-10-17T12:57:21.200398095Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CLSA-2024-1732492826","title":"TuxCare security update for org.xerial.snappy:snappy-java (4 CVEs)","description":"TuxCare rebuilt org.xerial.snappy:snappy-java to address 4 CVEs. Fixed in 1.1.8.4.tuxcare.","status":"published","published":"2026-08-04T14:52:03Z","modified":"2026-10-15T09:45:05.55838129Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2026-1777250302","title":"TuxCare security update for org.xerial.snappy:snappy-java (1 CVE)","description":"TuxCare rebuilt org.xerial.snappy:snappy-java to address 1 CVE. Fixed in 1.1.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:47:17.621575043Z","updated_at":"2026-11-02T15:43:44.384419Z"}]}}