CVE-2023-43642

Summary

CVE-2023-43642 is a newly disclosed vulnerability affecting snappy-java, a popular Java implementation of Google's fast compression library. This issue permits Denial of Service (DoS) attacks by exploiting the lack of an upper bound check on chunk length while decompressing data with snappy-java's SnappyInputStream. The vulnerability affects all versions of snappy-java, including the latest 1.1.10.3, and can result in unrecoverable fatal errors. To mitigate the risk, users are advised to upgrade to the upcoming 1.1.10.4 release, which includes a fix for this issue. Alternatively, users should only accept compressed data from trusted sources to prevent potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.