Read the docs
TI-2022-22550 Aliases CVE-2022-45688GHSA-3vqj-43w4-2q58

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows…

Priority HIGH 72CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-787 and the CVSS impact.

Summary

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01263 69th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed cn.hutool:hutool-json (Maven): 5.8.25org.json:json (Maven): 20230227

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—cn.hutool:hutool-json (Maven)before 5.8.255.8.25Patch availableGHSA-3vqj-43w4-2q58
—org.json:json (Maven)before 2023022720230227Patch availableGHSA-3vqj-43w4-2q58
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • cn.hutool:hutool-json (Maven) Vendor— Affected before 5.8.25 Fixed in 5.8.25 Patch available GHSA-3vqj-43w4-2q58
  • org.json:json (Maven) Vendor— Affected before 20230227 Fixed in 20230227 Patch available GHSA-3vqj-43w4-2q58

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:hutool:hutool:5.8.10:*:*:*:*:*:*:*5.8.10VulnerableHutool
cpe:2.3:a:stleary:json-java:*:*:*:*:*:*:*:*before 20230227Vulnerablestleary
  • cpe:2.3:a:hutool:hutool:5.8.10:*:*:*:*:*:*:* Versions 5.8.10 Vulnerable ·Hutool
  • cpe:2.3:a:stleary:json-java:*:*:*:*:*:*:*:* Versions before 20230227 Vulnerable ·stleary

Remediation

  • Fix · GHSA-3vqj-43w4-2q58 cn.hutool:hutool-json (Maven) Fixed in 5.8.25 Advisory →
  • Fix · GHSA-3vqj-43w4-2q58 org.json:json (Maven) Fixed in 20230227 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-45688
  2. 2026-10-03 Alias added: GHSA-3vqj-43w4-2q58

References

Exploit 2

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences