Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-43642

24
FAUCET Score

CVE-2023-43642 is a Denial of Service (DoS) vulnerability affecting all versions of xerial snappy-java, including 1.1.10.3. The vulnerability arises from a missing upper bound check on chunk length within the SnappyInputStream, allowing an attacker to trigger an unrecoverable fatal error by providing specially crafted compressed data with an excessively large chunk size. This issue carries a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high impact on availability, requiring no user interaction or privileges. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.1.10.4CPE matchmatch criteria
cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.04%
Probability of exploitation in next 30 days
EPSS Percentile
60.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0104 is in the 37th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (9)

github_advisorypatch availablevia nvd_reference
View patch
mavenpatch availablevia ghsa
Product: org.xerial.snappy:snappy-javaFixed in: 1.1.10.4
redhatpatch availablevia redhat_api
Product: Red Hat AMQ Streams 2.7.0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Quarkus 2.13.9.FinalFixed in: org.xerial.snappy/snappy-java:1.1.10.5-redhat-00001
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Quarkus 3.2.9.FinalFixed in: org.xerial.snappy/snappy-java:1.1.10.5-redhat-00001
View patch
redhatno patchvia redhat_api
Product: OpenShift ServerlessFixed in: snappy-java
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: log4j:2/log4j
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: log4j
redhatend of lifevia redhat_api
Product: Red Hat Software CollectionsFixed in: snappy-java

Vendor Advisories (2)

redhatCVE-2023-43642Moderate

snappy-java: Missing upper bound check on chunk length in snappy-java can lead to Denial of Service (DoS) impact

Sep 26, 2023
mavenGHSA-55g7-9cwv-5qfvhigh

snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact

Sep 25, 2023

References

github.com / xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5
Patch
github.com / xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv
Exploit