Read the docs
TI-2022-19038 Aliases CVE-2022-40149GHSA-56h3-78gp-v83r

Stack Buffer Overflow in Jettison

Priority LOW 36CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 17 fixed, 17 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-121 and the CVSS impact.

Summary

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01677 77th percentileScored 2026-11-07
Fix Partial org.codehaus.jettison:jettison (Maven): 1.5.1Red Hat: 17 advisoriesRed Hat: 17 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JettisonJettisonup to 1.4.0—No fix listedCNA
—org.codehaus.jettison:jettison (Maven)before 1.5.11.5.1Patch availableGHSA-56h3-78gp-v83r
  • Jettison VendorJettison Affected up to 1.4.0 Fixed in — No fix listed CNA
  • org.codehaus.jettison:jettison (Maven) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-56h3-78gp-v83r

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:jettison_project:jettison:*:*:*:*:*:*:*:*up to 1.4.0VulnerableJettison
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:jettison_project:jettison:*:*:*:*:*:*:*:* Versions up to 1.4.0 Vulnerable ·Jettison
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-56h3-78gp-v83r org.codehaus.jettison:jettison (Maven) Fixed in 1.5.1 Advisory →

Red Hat 17 advisories

  • RHSA-2025:4437 Released 2025-05-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.13 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-activemq-artemis-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-cli-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-commons-2.9.0-10.redhat_00021.1.el7eap +44
  • RHSA-2025:4226 Released 2025-04-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
  • RHSA-2023:3663 Released 2023-06-19 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1686831822-1.el8, jenkins-2.401.1.1686831596-3.el8
Show 14 more Red Hat advisories
  • RHSA-2023:3610 Released 2023-06-15 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1686649756-1.el8, jenkins-2.401.1.1686649641-3.el8
  • RHSA-2023:3223 Released 2023-05-18 · Red Hat rating Important
    Red Hat AMQ Streams 2.4.0 release and security update
    • Red Hat AMQ Streams 2.4.0
  • RHSA-2023:2135 Released 2023-05-04 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.3 security update
    • RHPAM 7.13.1 async
  • RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
  • RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
  • RHSA-2023:0556 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
  • RHSA-2023:0554 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
  • RHSA-2023:0552 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
  • RHSA-2023:0553 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
  • RHSA-2023:0544 Released 2023-01-30 · Red Hat rating Important
    Red Hat Camel for Spring Boot 3.14.5 Patch 1 release and security update
    • RHINT Camel-Springboot 3.14.5.P1
  • RHSA-2023:0469 Released 2023-01-26 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions For Quarkus 2.13.2
    • RHINT Camel-Q 2.13.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat build of QuarkusAffectedNo fix planned: Will not fix
Middleware Containers for OpenShiftFixed RHSA-2023:1047
OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8Fixed RHSA-2023:3663
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2023:3610
RHINT Camel-Q 2.13.2Fixed RHSA-2023:0469
RHINT Camel-Springboot 3.14.5.P1Fixed RHSA-2023:0544
RHPAM 7.13.1 asyncFixed RHSA-2023:2135
Red Hat AMQ Streams 2.4.0Fixed RHSA-2023:3223
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:4226
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:4437
Red Hat JBoss Enterprise Application Platform 7.4.9Fixed RHSA-2023:0556
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:1045
Not affected: 9 products
  • A-MQ Clients 2
  • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • OpenShift Developer Tools and Services for OCP 4.12
  • Red Hat Data Grid 8
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.9
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40149
  2. 2026-10-03 Alias added: GHSA-56h3-78gp-v83r
  3. 2026-11-05 Affected versions changed · Red Hat

References

Advisory 5

Other 3

  • TI-2023-01356 Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray CVSS 3.1HIGH 7.5
  • TI-2022-22553 Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. CVSS 3.1HIGH 7.5
  • TI-2022-22549 A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. CVSS 3.1HIGH 7.5
  • TI-2022-19039 Stack Buffer Overflow in Jettison CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences