Medium · 5.9 CVE-2023-3782 EUVD-2023-44415GHSA-w28c-cgxf-w8gv

DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response

Published Jul 19, 2023 · Updated Oct 28, 2024 · Assigned by JFROG

Description

Affected products

Vendor	Product	Affected	Fixed
—	com.squareup.okhttp3:okhttp-brotli	—	—

References

https://github.com/square/okhttp/issues/7738
https://research.jfrog.com/vulnerabilities/okhttp-client-brotli-dos/