Vulnerabilities

TI-2023-01356 CVE-2023-1436 · GHSA-q6g2-g7f3-rr83

Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

HIGH 72

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01009 Published 2023-03-16 Partial fix · 1.5.4 CWE-674

TI-2022-22553 CVE-2022-45693 · GHSA-grr4-wv38-f68w

HIGH 72

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01488 Published 2022-12-13 Partial fix · 1.5.2 CWE-787

TI-2022-22549 CVE-2022-45685 · GHSA-7rf3-mqpx-h7xg

MEDIUM 42

A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01488 Published 2022-12-13 Partial fix · 1.5.2 CWE-787

TI-2022-19039 CVE-2022-40150 · GHSA-x27m-9w8j-5vcw

LOW 36

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01647 Published 2022-09-16 Partial fix · 1.5.2 CWE-400

TI-2022-19038 CVE-2022-40149 · GHSA-56h3-78gp-v83r

LOW 36

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01677 Published 2022-09-16 Partial fix · 1.5.1 CWE-121