Multiple parsing problems in the Apache Sling Commons JSON module
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | org.apache.sling.commons.json | up to 2.0.20 | — | No fix listed | CNA |
| — | org.apache.sling:org.apache.sling.commons.json (Maven) | up to 2.0.20 | — | No fix listed | GHSA-8j28-34qq-gmch |
- org.apache.sling.commons.json VendorApache Affected up to 2.0.20 Fixed in — No fix listed CNA
- org.apache.sling:org.apache.sling.commons.json (Maven) Vendor— Affected up to 2.0.20 Fixed in — No fix listed GHSA-8j28-34qq-gmch
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-47937
- 2026-10-03 Alias added: GHSA-8j28-34qq-gmch
References
Advisory 3
Sources
- CVE-2022-47937 · CVE Program
- CVE-2022-47937 · NVD
- FIRST EPSS
- GHSA-8j28-34qq-gmch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences