Vulnerability · Published Jul 12, 2023 · Assigned by JFROG
CVE-2023-3635Okio GzipSource unhandled exception Denial of Service
Medium 5.9
In plain English
A medium-severity security flaw in com.squareup.okio:okio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)1.3%top 30.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.squareup.okio:okio | 3.4.0 | GHSA-w33c-445m-f8w7 |
| Maven | com.squareup.okio:okio | 1.17.6 | GHSA-w33c-445m-f8w7 |
| Maven | com.squareup.okio:okio-jvm | 3.4.0 | GHSA-w33c-445m-f8w7 |
| Ubuntu:22.04:LTS | okio | no fix listed | UBUNTU-CVE-2023-3635 |
| Ubuntu:24.04:LTS | okio | no fix listed | UBUNTU-CVE-2023-3635 |
| Ubuntu:25.10 | okio | no fix listed | UBUNTU-CVE-2023-3635 |
| Ubuntu:26.04:LTS | okio | no fix listed | UBUNTU-CVE-2023-3635 |
| Ubuntu:26.10 | okio | no fix listed | UBUNTU-CVE-2023-3635 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| com.squareup.okio:okio | 0.5.0 – before 1.0.01.0.0 – before 1.17.62.0.0 – before 3.0.03.0.0 – before 3.4.0 |
Weakness: CWE-195 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H