Okio GzipSource unhandled exception Denial of Service
Priority LOW 35CWE-195Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 fixed, 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01254 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial com.squareup.okio:okio: 1.17.6, 3.4.0com.squareup.okio:okio (Maven): 3.4.0, 1.17.6+1 more productRed Hat: 4 advisoriesRed Hat: 5 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | com.squareup.okio:okio | 0.5.0 to before 1.0.0; 1.0.0 to before 1.17.6; 2.0.0 to before 3.0.0; 3.0.0 to before 3.4.0 | 1.17.6, 3.4.0 | Patch available | CNA |
| — | com.squareup.okio:okio (Maven) | 2.0.0-RC1 to before 3.4.0 | 3.4.0 | Patch available | GHSA-w33c-445m-f8w7 |
| — | com.squareup.okio:okio (Maven) | before 1.17.6 | 1.17.6 | Patch available | GHSA-w33c-445m-f8w7 |
| — | com.squareup.okio:okio-jvm (Maven) | 2.0.0-RC1 to before 3.4.0 | 3.4.0 | Patch available | GHSA-w33c-445m-f8w7 |
- com.squareup.okio:okio Vendor— Affected 0.5.0 to before 1.0.0; 1.0.0 to before 1.17.6; 2.0.0 to before 3.0.0; 3.0.0 to before 3.4.0 Fixed in 1.17.6, 3.4.0 Patch available CNA
- com.squareup.okio:okio (Maven) Vendor— Affected 2.0.0-RC1 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-w33c-445m-f8w7
- com.squareup.okio:okio (Maven) Vendor— Affected before 1.17.6 Fixed in 1.17.6 Patch available GHSA-w33c-445m-f8w7
- com.squareup.okio:okio-jvm (Maven) Vendor— Affected 2.0.0-RC1 to before 3.4.0 Fixed in 3.4.0 Patch available GHSA-w33c-445m-f8w7
Remediation
- Fix · CNA com.squareup.okio:okio Fixed in 1.17.6, 3.4.0
- Fix · GHSA-w33c-445m-f8w7 com.squareup.okio:okio (Maven) Fixed in 3.4.0 Advisory →
- Fix · GHSA-w33c-445m-f8w7 com.squareup.okio:okio (Maven) Fixed in 1.17.6 Advisory →
- Fix · GHSA-w33c-445m-f8w7 com.squareup.okio:okio-jvm (Maven) Fixed in 3.4.0 Advisory →
Red Hat 4 advisories
- RHSA-2024:6667 Released 2024-09-12 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.16.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/configbump-rhel8, devspaces/dashboard-rhel8 +10
- RHSA-2024:1353 Released 2024-03-18 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.5 security update
- RHPAM 7.13.5 async
- RHSA-2023:7247 Released 2023-11-15 · Red Hat rating CriticalRed Hat Fuse 7.12.1 release and security update
- Red Hat Fuse 7.12.1
Show 1 more Red Hat advisories
- RHSA-2023:5165 Released 2023-09-14 · Red Hat rating ImportantRed Hat AMQ Streams 2.5.0 release and security update
- Red Hat AMQ Streams 2.5.0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka | Affected | No fix yet |
| RHPAM 7.13.5 async | Fixed | RHSA-2024:1353 |
| Red Hat AMQ Streams 2.5.0 | Fixed | RHSA-2023:5165 |
| Red Hat Fuse 7.12.1 | Fixed | RHSA-2023:7247 |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Fixed | RHSA-2024:3385 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2024:6667 |
Not affected: 3 products
- Cryostat 2
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3635
- 2026-10-03 Alias added: GHSA-w33c-445m-f8w7
References
Exploit 1
Other 6
- https://github.com/square/okio/pull/1280
- https://github.com/square/okio/pull/1334
- https://github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839
- https://github.com/square/okio
- https://github.com/square/okio/blob/master/CHANGELOG.md#version-1176
- https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195
Sources
- CVE-2023-3635 · CVE Program
- CVE-2023-3635 · NVD
- FIRST EPSS
- GHSA-w33c-445m-f8w7 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-3635 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences