Maven/org.xerial.snappy:snappy-java CVE-2023-34453: medium 5.9, EPSS 1.71%

snappy-java's Integer Overflow vulnerability in shuffle leads to DoS

Action: Upgrade org.xerial.snappy:snappy-java to 1.1.10.1 or later.

Affected

Fixed versions

Sources

• osv: GHSA-pqr6-cmr2-h8hf
• https://github.com/xerial/snappy-java/security/advisories/GHSA-pqr6-cmr2-h8hf
• https://nvd.nist.gov/vuln/detail/CVE-2023-34453
• https://github.com/xerial/snappy-java/commit/820e2e074c58748b41dbd547f4edba9e108ad905
• https://github.com/xerial/snappy-java
• https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/BitShuffle.java#L107
• https://github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/BitShuffle.java

CVE-2023-34453 · published 2023-06-15T16:13:20Z · modified 2026-09-10T03:50:08.421776299Z · JSON