Missing upper bound check on chunk length in snappy-java

CVE-2023-43642

What is CVE-2023-43642?

The snappy-java library, a Java adaptation of Google's Snappy compression algorithm, is susceptible to Denial of Service attacks due to an unchecked upper bound on chunk sizes during decompression. This flaw can lead to unrecoverable emergencies when processing overly large data chunks, potentially halting application functionality. All current versions of snappy-java, including 1.1.10.3, are impacted. Users are strongly urged to update to version 1.1.10.4, which integrates the necessary fix. For those unable to upgrade immediately, it's critical to only process compressed data from trusted origins to mitigate risks.

References