CVE-2023-3635: Squareup Okio

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Affected products

• Squareup Okio: from 0.5.0, before 1.17.6 (fixed in 1.17.6); from 2.0.0, before 3.4.0 (fixed in 3.4.0)

Published 2023-07-12. Last modified 2026-06-17.