Loading vulnerability…
CVE-2023-46442 is a vulnerability in Soot before version 4.4.1, specifically in the retrieveActiveBody function, which under Java 8 can enter an infinite loop. This allows an attacker to trigger a Denial of Service (DoS) condition by causing the function to never return, consuming system resources indefinitely.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a proof-of-concept (POC) for CVE-2023-46442, a denial of service vulnerability in Soot (prior to version 4.4.1) when running under Java 8. The repository contains a Java program (POC.java) that uses the Soot framework to process a maliciously crafted class file (Build$Builder.class, referenced in the README but not present in the file listing). When Soot attempts to retrieve the body of a method from this class file, it enters an infinite loop or consumes excessive resources, leading to a denial of service (DoS) condition. The exploit is local and requires the attacker to supply the malicious class file to a Soot instance. The repository structure includes a Maven build file (pom.xml), the exploit code (POC.java), and references to the payload class file. The main entry point is POC.java, which demonstrates the vulnerability by processing the payload and triggering the DoS.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.