Read the docs
TI-2023-03751 Aliases CVE-2023-4043GHSA-g8p6-p27c-52fx

Parsson DoS when parsing numbers from untrusted sources

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0089 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Parsson (Eclipse Foundation): 1.0.5, 1.1.4org.eclipse.parsson:project (Maven): 1.1.4, 1.0.5Red Hat: 7 advisoriesRed Hat: 7 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationParssonbefore 1.0.5; 1.1.0 to before 1.1.41.0.5, 1.1.4Patch availableCNA
—org.eclipse.parsson:project (Maven)1.1.0 to before 1.1.41.1.4Patch availableGHSA-g8p6-p27c-52fx
—org.eclipse.parsson:project (Maven)before 1.0.51.0.5Patch availableGHSA-g8p6-p27c-52fx
  • Parsson VendorEclipse Foundation Affected before 1.0.5; 1.1.0 to before 1.1.4 Fixed in 1.0.5, 1.1.4 Patch available CNA
  • org.eclipse.parsson:project (Maven) Vendor— Affected 1.1.0 to before 1.1.4 Fixed in 1.1.4 Patch available GHSA-g8p6-p27c-52fx
  • org.eclipse.parsson:project (Maven) Vendor— Affected before 1.0.5 Fixed in 1.0.5 Patch available GHSA-g8p6-p27c-52fx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:parsson:*:*:*:*:*:*:*:*before 1.0.5; 1.1.0 to before 1.1.4VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:parsson:*:*:*:*:*:*:*:* Versions before 1.0.5; 1.1.0 to before 1.1.4 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · CNA Parsson (Eclipse Foundation) Fixed in 1.0.5, 1.1.4
  • Fix · GHSA-g8p6-p27c-52fx org.eclipse.parsson:project (Maven) Fixed in 1.1.4 Advisory →
  • Fix · GHSA-g8p6-p27c-52fx org.eclipse.parsson:project (Maven) Fixed in 1.0.5 Advisory →

Red Hat 7 advisories

  • RHSA-2024:1194 Released 2024-03-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0.1 security update
    • EAP 8.0.1
  • RHSA-2024:1192 Released 2024-03-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0.1 security update
    • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-apache-sshd-2.12.0-1.redhat_00001.1.el8eap, eap8-eclipse-jgit-6.6.1.202309021850-1.r_redhat_00001.1.el8eap, eap8-log4j-2.19.0-2.redhat_00001.1.el8eap +12
  • RHSA-2024:1193 Released 2024-03-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 8.0.1 security update
    • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-apache-sshd-2.12.0-1.redhat_00001.1.el9eap, eap8-eclipse-jgit-6.6.1.202309021850-1.r_redhat_00001.1.el9eap, eap8-log4j-2.19.0-2.redhat_00001.1.el9eap +12
Show 4 more Red Hat advisories
  • RHSA-2024:0793 Released 2024-02-12 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 4.0.3 release security update
    • RHINT Camel-Springboot 4.0.3
  • RHSA-2024:0789 Released 2024-02-12 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.0 for Quarkus 3.2 release (RHBQ 3.2.10.Final)
    • RHBOAC camel-quarkus 3 (camel-4.0/quarkus-3.2)
  • RHSA-2024:0722 Released 2024-02-12 · Red Hat rating Important
    Red Hat build of Quarkus 3.2.10 release and security update
    • Red Hat build of Quarkus 3.2.10.Final org.eclipse.parsson.parsson-1.1.5.redhat-00001.jar
  • RHSA-2024:0530 Released 2024-01-25 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of KeycloakAffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Cryostat 2 on RHEL 8Fixed RHSA-2024:0530
EAP 8.0.1Fixed RHSA-2024:1194
RHBOAC camel-quarkus 3 (camel-4.0/quarkus-3.2)Fixed RHSA-2024:0789
RHINT Camel-Springboot 4.0.3Fixed RHSA-2024:0793
Red Hat JBoss EAP 8.0 for RHEL 8Fixed RHSA-2024:1192
Red Hat JBoss EAP 8.0 for RHEL 9Fixed RHSA-2024:1193
Red Hat build of Quarkus 3.2.10.FinalFixed RHSA-2024:0722
Not affected: 5 products
  • Red Hat Fuse 7
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Quarkus 3.2.10.Final
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4043
  2. 2026-10-03 Alias added: GHSA-g8p6-p27c-52fx
  3. 2026-10-08 Affected versions changed · Red Hat
  4. 2026-10-09 Fix available: Red Hat build of Quarkus 3.2.10 · Red Hat
  5. 2026-10-20 Fix available: Red Hat build of Quarkus 3.2.10.Final · Red Hat

References

Exploit 1

Patch 1

Advisory 1

  • TI-2023-06651 Eclipse Parsson stack overflow with deeply nested objects CVSS 3.1HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences