Vulnerabilities

TI-2025-35410 CVE-2025-56769 · GHSA-gcfh-36x4-mgj6

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to…

HIGH 70

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngin…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0034 Published 2025-09-25 Fixed in 5.8.40 CWE-77

TI-2023-27924 CVE-2023-51080 · GHSA-m5hf-m3r2-xq53

The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.

LOW 34

The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00619 Published 2023-12-27 Fixed in 5.8.25 CWE-787

TI-2023-27922 CVE-2023-51075 · GHSA-7m7h-rgvp-3v4r

hutool-core v5.8.23 was discovered to contain an infinite loop in the…

MEDIUM 40

hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00654 Published 2023-12-27 Fixed in 5.8.24 CWE-835

TI-2023-22549 CVE-2023-42278 · GHSA-rr66-qh5m-w6mx

hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().

HIGH 72

hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00837 Published 2023-09-08 Fixed in 5.8.22 CWE-120

TI-2023-22548 CVE-2023-42277 · GHSA-7p8c-crfr-q93p

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.

HIGH 82

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00911 Published 2023-09-08 No fix listed CWE-120

TI-2023-22547 CVE-2023-42276 · GHSA-rxgf-r843-g53h

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.

HIGH 82

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00911 Published 2023-09-08 No fix listed CWE-120

TI-2023-16646 CVE-2023-33695 · GHSA-7mcw-xmx3-7p8m

Hutool v5.8.17 and below was discovered to contain an information disclosure…

LOW 33

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00244 Published 2023-06-13 Fixed in 5.8.19 CWE-732

TI-2023-09905 CVE-2023-24163 · GHSA-6c25-cxcc-pmc4

SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute…

MEDIUM 52

SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01381 Published 2023-01-31 Fixed in 5.8.21 CWE-89

TI-2023-09904 CVE-2023-24162 · GHSA-77h8-5j3h-jcjf

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute…

HIGH 82

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0127 Published 2023-01-31 No fix listed CWE-502

TI-2022-04169 CVE-2022-4565 · GHSA-47vx-fqr5-j2gw

Dromara HuTool cn.hutool.core.util.ZipUtil.java resource consumption

LOW 35

A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00957 Published 2022-12-16 Fixed in 5.8.11 CWE-404

TI-2022-22552 CVE-2022-45690 · GHSA-whgh-g24c-3j5q

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of…

HIGH 72

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01006 Published 2022-12-13 Fixed in 5.8.11 CWE-787

TI-2022-22551 CVE-2022-45689 · GHSA-fxrc-hg6j-6v3x

hutool-json v5.8.10 was discovered to contain an out of memory error.

HIGH 72

hutool-json v5.8.10 was discovered to contain an out of memory error.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00799 Published 2022-12-13 No fix listed CWE-787

TI-2022-22550 CVE-2022-45688 · GHSA-3vqj-43w4-2q58

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows…

HIGH 72

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01263 Published 2022-12-13 Fixed in 5.8.25, 20230227 CWE-787

TI-2022-07091 CVE-2022-22885 · GHSA-p7w9-8mxw-p3g7

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.

MEDIUM 45

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01301 Published 2022-02-16 Fixed in 5.7.19 CWE-295

TI-2018-12341 CVE-2018-17297 · GHSA-rhq2-2574-78mc

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to…

LOW 38

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02674 Published 2018-09-21 Fixed in 4.1.12 CWE-22

Vulnerabilities

Filters