Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON
Priority HIGH 72CWE-674Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 16 fixed, 14 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.
Summary
[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01119 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial json-smart (json-smart): 2.4.9net.minidev:json-smart (Maven): 2.4.9Red Hat: 16 advisoriesRed Hat: 16 fixed, 14 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| json-smart | json-smart | before 2.4.9 | 2.4.9 | Patch available | CNA |
| — | net.minidev:json-smart (Maven) | before 2.4.9 | 2.4.9 | Patch available | GHSA-493p-pfq6-5258 |
- json-smart Vendorjson-smart Affected before 2.4.9 Fixed in 2.4.9 Patch available CNA
- net.minidev:json-smart (Maven) Vendor— Affected before 2.4.9 Fixed in 2.4.9 Patch available GHSA-493p-pfq6-5258
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:json-smart_project:json-smart:*:*:*:*:*:*:*:* | before 2.4.9 | Vulnerable | Json-smart Project |
- cpe:2.3:a:json-smart_project:json-smart:*:*:*:*:*:*:*:* Versions before 2.4.9 Vulnerable ·Json-smart Project
Remediation
- Fix · CNA json-smart (json-smart) Fixed in 2.4.9
- Fix · GHSA-493p-pfq6-5258 net.minidev:json-smart (Maven) Fixed in 2.4.9 Advisory →
Red Hat 16 advisories
- RHSA-2025:12511 Released 2025-08-01 · Red Hat rating ImportantStreams for Apache Kafka 3.0.0 release and security update
- Streams for Apache Kafka 3.0.0
- RHSA-2025:9922 Released 2025-06-30 · Red Hat rating ImportantStreams for Apache Kafka 2.9.1 release and security update
- Streams for Apache Kafka 2.9.1
- RHSA-2024:3527 Released 2024-05-30 · Red Hat rating ModerateRed Hat AMQ Streams 2.7.0 release and security update
- Red Hat AMQ Streams 2.7.0
Show 13 more Red Hat advisories
- RHSA-2023:7697 Released 2023-12-07 · Red Hat rating ModerateAMQ Clients 2023.Q4
- Red Hat AMQ Clients
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
- RHSA-2023:3906 Released 2023-06-28 · Red Hat rating ImportantRed Hat Integration Camel K 1.10.1 release security update
- RHINT Camel-K-1.10.1
- RHSA-2023:3663 Released 2023-06-19 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1686831822-1.el8, jenkins-2.401.1.1686831596-3.el8
- RHSA-2023:3641 Released 2023-06-15 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release
- RHINT Camel-Springboot 3.18.3.P2
- RHSA-2023:3622 Released 2023-06-15 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1686680473-1.el8, jenkins-2.401.1.1686680404-3.el8
- RHSA-2023:3610 Released 2023-06-15 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1686649756-1.el8, jenkins-2.401.1.1686649641-3.el8
- RHSA-2023:3362 Released 2023-06-07 · Red Hat rating ImportantOpenShift Container Platform 4.10.61 packages and security update
- Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1684982411-1.el8
- RHSA-2023:3223 Released 2023-05-18 · Red Hat rating ImportantRed Hat AMQ Streams 2.4.0 release and security update
- Red Hat AMQ Streams 2.4.0
- RHSA-2023:3193 Released 2023-05-17 · Red Hat rating ImportantRed Hat Integration Camel Extensions for Quarkus 2.7.1-1 security update
- CEQ 2.7.1-1
- RHSA-2023:3179 Released 2023-05-17 · Red Hat rating ImportantRed Hat Integration Camel Extensions For Quarkus 2.13.2-2 security update
- CEQ 2.13.2-2
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
- RHSA-2023:2099 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.18.3 Patch 1 security update
- RHINT Camel-Springboot 3.18.3.P1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel Quarkus 2 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix yet |
| Red Hat build of Debezium 1 | Affected | No fix yet |
| streams for Apache Kafka | Affected | No fix yet |
| CEQ 2.13.2-2 | Fixed | RHSA-2023:3179 |
| CEQ 2.7.1-1 | Fixed | RHSA-2023:3193 |
| OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 | Fixed | RHSA-2023:3663 |
| OpenShift Developer Tools and Services for OCP 4.12 | Fixed | RHSA-2023:3610 |
| OpenShift Developer Tools and Services for OCP 4.13 | Fixed | RHSA-2023:3622 |
| RHINT Camel-K-1.10.1 | Fixed | RHSA-2023:3906 |
| RHINT Camel-Springboot 3.18.3.P1 | Fixed | RHSA-2023:2099 |
| RHINT Camel-Springboot 3.18.3.P2 | Fixed | RHSA-2023:3641 |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
| Red Hat AMQ Clients | Fixed | RHSA-2023:7697 |
| Red Hat AMQ Streams 2.4.0 | Fixed | RHSA-2023:3223 |
| Red Hat AMQ Streams 2.7.0 | Fixed | RHSA-2024:3527 |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2023:3362 |
| Streams for Apache Kafka 2.9.1 | Fixed | RHSA-2025:9922 |
| Streams for Apache Kafka 3.0.0 | Fixed | RHSA-2025:12511 |
Not affected: 11 products
- Logging Subsystem for Red Hat OpenShift
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
- OpenShift Developer Tools and Services for OCP 4.12
- OpenShift Developer Tools and Services for OCP 4.13
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Container Platform 4.10
- Red Hat Single Sign-On 7
- Red Hat support for Spring Boot
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1370
- 2026-10-03 Alias added: GHSA-493p-pfq6-5258
- 2026-11-05 Affected versions changed · Red Hat
References
Other 8
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://github.com/netplex/json-smart-v2/issues/137
- https://github.com/netplex/json-smart-v2/commit/5b3205d051952d3100aa0db1535f6ba6226bd87a
- https://github.com/netplex/json-smart-v2/commit/e2791ae506a57491bc856b439d706c81e45adcf8
- https://github.com/oswaldobapvicjr/jsonmerge
- https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://www.cve.org/CVERecord?id=CVE-2023-1370
More json-smart vulnerabilities
- TI-2026-76931 Strict-mode validation bypass in json-smart via 0x1A character CVSS 4.0MEDIUM 6.9
Sources
- CVE-2023-1370 · CVE Program
- CVE-2023-1370 · NVD
- FIRST EPSS
- GHSA-493p-pfq6-5258 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-1370 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences