CVE-2023-3782

Summary

DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response

Affected Software

Weaknesses

• CWE-400: CWE-400 Uncontrolled Resource Consumption

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/square/okhttp/issues/7738
• https://research.jfrog.com/vulnerabilities/okhttp-client-brotli-dos/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/square/okhttp/issues/7738
• https://research.jfrog.com/vulnerabilities/okhttp-client-brotli-dos/

• ←Previous
• Next→