CVE-2023-34455

snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given stream has more chunks to read. It does that by attempting to read 4 bytes. If it wasn’t possible to read the 4 bytes, the function returns false. Otherwise, if 4 bytes were available, the code treats them as the length of the next chunk. In the case that the `compressed` variable is null, a byte array is allocated with the size given by the input data. Since the code doesn’t test the legality of the `chunkSize` variable, it is possible to pass a negative number (such as 0xFFFFFFFF which is -1), which will cause the code to raise a `java.lang.NegativeArraySizeException` exception. A worse case would happen when passing a huge positive value (such as 0x7FFFFFFF), which would raise the fatal `java.lang.OutOfMemoryError` error. Version 1.1.10.1 contains a patch for this issue.

• CWE-770
• CWE-770

• https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/SnappyInputStream.java#L388Issue Tracking
• https://github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/SnappyInputStream.javaIssue Tracking
• https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaeaPatch
• https://github.com/xerial/snappy-java/security/advisories/GHSA-qcwq-55hx-v3vhExploit, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230818-0009/Third Party Advisory
• https://github.com/xerial/snappy-java/blob/05c39b2ca9b5b7b39611529cc302d3d796329611/src/main/java/org/xerial/snappy/SnappyInputStream.java#L388Issue Tracking
• https://github.com/xerial/snappy-java/blob/master/src/main/java/org/xerial/snappy/SnappyInputStream.javaIssue Tracking
• https://github.com/xerial/snappy-java/commit/3bf67857fcf70d9eea56eed4af7c925671e8eaeaPatch
• https://github.com/xerial/snappy-java/security/advisories/GHSA-qcwq-55hx-v3vhExploit, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230818-0009/Third Party Advisory

Published

Jun 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3445Cross-site Scripting (XSS) - Stored in GitHub repository spi…4.8
• CVE-2023-34450CometBFT is a Byzantine Fault Tolerant (BFT) middleware that…5.3
• CVE-2023-34451CometBFT is a Byzantine Fault Tolerant (BFT) middleware that…8.2
• CVE-2023-34452Grav is a flat-file content management system. In versions 1…6.1
• CVE-2023-34453snappy-java is a fast compressor/decompressor for Java. Due …7.5
• CVE-2023-34454snappy-java is a fast compressor/decompressor for Java. Due …7.5
• CVE-2023-34457MechanicalSoup is a Python library for automating interactio…7.5
• CVE-2023-34458mx-chain-go is the official implementation of the MultiversX…5.3
• CVE-2023-34459OpenZeppelin Contracts is a library for smart contract devel…5.9
• CVE-2023-3446Issue summary: Checking excessively long DH keys or paramete…5.3
• CVE-2023-34460Tauri is a framework for building binaries for all major des…9.8
• CVE-2023-34461PyBB is an open source bulletin board. A manual code review …5.4