Denial of Service Vulnerability in snappy-java: Critical Chunk Size Issue
Summary
CVE-2023-43642: snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Affects snappy-java versions < 9f8c3cf74223ed0a8a834134be9c917b9f10ceb5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
snappy-java is a Java implementation of the Snappy compression algorithm developed by Google. It is designed for high-speed compression and decompression of data, making it suitable for applications that require efficient data handling. However, the package has been found to have a vulnerability that can lead to Denial of Service (DoS) attacks when decompressing data with excessively large chunk sizes.
Vulnerability Detail
The vulnerability arises from a lack of upper bound checks on the chunk length in the SnappyInputStream class. When decompressing data, if the chunk size exceeds a certain limit, it can cause an unrecoverable fatal error, leading to a Denial of Service. This issue affects all versions of snappy-java, including the latest release, 1.1.10.3. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, users should only accept compressed data from trusted sources to mitigate the risk of exploitation. This precaution can help prevent potential attacks until the software can be updated.
Conclusion
The vulnerability in snappy-java poses a significant risk due to its potential to cause Denial of Service attacks. Users are strongly advised to upgrade to version 1.1.10.4 or later to mitigate this risk. Until an upgrade can be performed, accepting compressed data only from trusted sources is crucial.
See every vulnerability recorded for snappy-java →
FAQ
The vulnerability is a Denial of Service (DoS) issue caused by a lack of checks on the chunk size during decompression, which can lead to fatal errors.
All versions of snappy-java, including the latest version 1.1.10.3, are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade, ensure that you only accept compressed data from trusted sources to reduce the risk of exploitation.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for snappy-java.
