{
  "cveId": "CVE-2023-43642",
  "url": "https://patchblox.com/security/cve/CVE-2023-43642",
  "summary": "CVE-2023-43642 is fixed in snappy-java on 1 platform, first by DEBIAN-CVE-2023-43642, released September 25, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "snappy-java: snappy-java is a Java port of the snappy, a fast C\u002B\u002B compresser/decompresser developed by Google",
  "description": "snappy-java is a Java port of the snappy, a fast C\u002B\u002B compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit \u00609f8c3cf74\u0060 which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.",
  "published": "2023-09-25T20:15:11Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.01211,
  "epssPercentile": 0.68664,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "snappy-java",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.1.10.5-1",
      "fix": "DEBIAN-CVE-2023-43642",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-43642",
      "released": "2023-09-25T20:15:11Z"
    },
    {
      "platform": "linux",
      "product": "snappy-java",
      "release": "Debian 14",
      "fixedVersion": "1.1.10.5-1",
      "fix": "DEBIAN-CVE-2023-43642",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-43642",
      "released": "2023-09-25T20:15:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}