CVE-2023-3782

MEDIUM 5.9EPSS 0.7%

DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response

CVSS v3.1: 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3.1: 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.72% chance of exploitation in the next 30 days, 51th percentile
Published: 2023-07-19
Updated: 2024-10-28

Proof-of-concept exploits (1)

https://research.jfrog.com/vulnerabilities/okhttp-client-brotli-dos/

References

Related