Skip to content
CVE IDCVE-2023-3635GitHub advisory IDGHSA-w33c-445m-f8w7

Okio Signed to Unsigned Conversion Error vulnerability

CVE-2023-3635 (GitHub advisory GHSA-w33c-445m-f8w7) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.9, classed as Signed to Unsigned Conversion Error (CWE-195), in com.squareup.okio:okio (Maven) and com.squareup.okio:okio-jvm (Maven). Fixed versions: com.squareup.okio:okio 3.4.0 or 1.17.6; com.squareup.okio:okio-jvm 3.4.0.

Medium5.9Fix availableGitHub reviewed

Published 12 Jul 2023Updated 23 Oct 2024

5.9MediumCVSS 3.1
CVE ID
CVE-2023-3635
GHSA ID
GHSA-w33c-445m-f8w7
EPSS
1.25%higher than 68% of CVEs
Weaknesses (CWE)
  • CWE-195Signed to Unsigned Conversion Error
  • CWE-681Incorrect Conversion between Numeric Types
KEV status
Not in KEV
Published
12 Jul 2023
Updated
23 Oct 2024
Ecosystem
  • Maven
Assigned by (CNA)
JFROG

Summary

Source: OSV (GitHub advisory)

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Medium5.9Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
High
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
None
Integrity I
None
Availability A
High

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
no
Needs manual steps per target
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • com.squareup.okio:okio
    Maven
    pkg:maven/com.squareup.okio/okio
    Affected versions
    >= 2.0.0-RC1, < 3.4.0
    < 1.17.6
    Fixed in
    3.4.0
    1.17.6
    Show 65 listed versions
    • 2.0.0
    • 2.0.0-RC1
    • 2.1.0
    • 2.10.0
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.4.3
  • com.squareup.okio:okio-jvm
    Maven
    pkg:maven/com.squareup.okio/okio-jvm
    Affected versions
    >= 2.0.0-RC1, < 3.4.0
    Fixed in
    3.4.0
    Show 6 listed versions
    • 3.0.0
    • 3.0.0-alpha.10
    • 3.0.0-alpha.11
    • 3.1.0
    • 3.2.0
    • 3.3.0

Fix

Source: OSV (GitHub advisory)

Fix available

  • com.squareup.okio:okio: upgrade to 3.4.0 or 1.17.6, depending on your release line
  • com.squareup.okio:okio-jvm: upgrade to 3.4.0 or later

Patch commits

  • 81bce1aPatch commitgithub.com/square/okio

    Fix a bug where xlen larger than 0x7fff was rejected (#1280)

    +19 −5 across 2 files

    • okio/src/jvmMain/kotlin/okio/GzipSource.kt+1 −1
    • okio/src/jvmTest/kotlin/okio/GzipKotlinTest.kt+18 −4
  • b4fa875Patch commitgithub.com/square/okio

    Fix a bug where xlen larger than 0x7fff was rejected (#1334)

    +16 −2 across 2 files

    • okio/src/main/java/okio/GzipSource.java+1 −1
    • okio/src/test/java/okio/GzipSourceTest.java+15 −1
  • #1280Pull requestgithub.com/square/okio
  • #1334Pull requestgithub.com/square/okio

Vulnerability intelligence

References

Credits

Questions about CVE-2023-3635

What is the GHSA ID for CVE-2023-3635?
GitHub tracks CVE-2023-3635 as GHSA-w33c-445m-f8w7.
What is the CVSS score of CVE-2023-3635?
CVE-2023-3635 has a CVSS 3.1 base score of 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Which versions are affected by CVE-2023-3635?
com.squareup.okio:okio (Maven): >= 2.0.0-RC1, < 3.4.0; < 1.17.6. com.squareup.okio:okio-jvm (Maven): >= 2.0.0-RC1, < 3.4.0.
How do I fix CVE-2023-3635?
Upgrade each package to its fixed version: com.squareup.okio:okio 3.4.0 or 1.17.6; com.squareup.okio:okio-jvm 3.4.0. The fix is in commits 81bce1a and b4fa875 and pull requests #1280 and #1334.
What is the Package URL (PURL) for CVE-2023-3635?
The affected packages' PURLs are pkg:maven/com.squareup.okio/okio and pkg:maven/com.squareup.okio/okio-jvm.
Is CVE-2023-3635 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2023-3635. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 68% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 14:00 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.