snappy-java's unchecked chunk length leads to DoS

CVE-2023-34455

What is CVE-2023-34455?

The snappy-java library for Java is susceptible to a vulnerability that arises from improper handling of chunk lengths in the decompression process. In versions prior to 1.1.10.1, the library's method for checking stream chunks does not validate the chunk size sufficiently. This can lead to an attempt to allocate an invalid array size; specifically, negative or excessively large values may trigger java.lang.NegativeArraySizeException or java.lang.OutOfMemoryError, respectively. Such failures can cause application crashes or significant resource exhaustion, impacting system availability. Users are urged to update to version 1.1.10.1 or later to mitigate these risks effectively.

References