Read the docs
TI-2021-11750 Aliases CVE-2021-31684GHSA-fg2v-w576-w4v3

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON…

Priority LOW 37CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02281 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial net.minidev:json-smart (Maven): 1.3.3, 2.4.4Red Hat: 1 advisoryRed Hat: 1 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—net.minidev:json-smart (Maven)1.3.0 to before 1.3.31.3.3Patch availableGHSA-fg2v-w576-w4v3
—net.minidev:json-smart (Maven)2.4.0 to before 2.4.42.4.4Patch availableGHSA-fg2v-w576-w4v3
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • net.minidev:json-smart (Maven) Vendor— Affected 1.3.0 to before 1.3.3 Fixed in 1.3.3 Patch available GHSA-fg2v-w576-w4v3
  • net.minidev:json-smart (Maven) Vendor— Affected 2.4.0 to before 2.4.4 Fixed in 2.4.4 Patch available GHSA-fg2v-w576-w4v3

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:json-smart_project:json-smart-v1:*:*:*:*:*:*:*:*1.3 to before 1.3.3VulnerableJson-smart Project
cpe:2.3:a:json-smart_project:json-smart-v2:*:*:*:*:*:*:*:*2.4 to before 2.4.4VulnerableJson-smart Project
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*4.4.0.0.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*4.4.0.2.0VulnerableOracle
cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*4.4.0.3.0VulnerableOracle
  • cpe:2.3:a:json-smart_project:json-smart-v1:*:*:*:*:*:*:*:* Versions 1.3 to before 1.3.3 Vulnerable ·Json-smart Project
  • cpe:2.3:a:json-smart_project:json-smart-v2:*:*:*:*:*:*:*:* Versions 2.4 to before 2.4.4 Vulnerable ·Json-smart Project
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* Versions 4.4.0.3.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-fg2v-w576-w4v3 net.minidev:json-smart (Maven) Fixed in 1.3.3 Advisory →
  • Fix · GHSA-fg2v-w576-w4v3 net.minidev:json-smart (Maven) Fixed in 2.4.4 Advisory →

Red Hat 1 advisory

  • RHSA-2022:8652 Released 2022-11-28 · Red Hat rating Important
    Red Hat Fuse 7.11.1 release and security update
    • Red Hat Fuse 7.11.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Integration Data Virtualisation OperatorAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix yet
Red Hat Fuse 7.11.1Fixed RHSA-2022:8652
Not affected: 12 products
  • A-MQ Clients 2
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Application Runtimes
  • Red Hat build of Debezium 1
  • Red Hat support for Spring Boot
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31684
  2. 2026-10-03 Alias added: GHSA-fg2v-w576-w4v3

References

Exploit 1

Patch 3

Advisory 2

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences