CVE-2023-1436

Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

Affected

jettison

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 JFROG

5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

1.01% chance of exploitation in the next 30 days, 63rd percentile

Published

2023-03-16

Updated

2025-02-26

Proof-of-concept exploits (1)

• https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/

Security advisories

• https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911
• advisories/GHSA-q6g2-g7f3-rr83

References

• CVE Record
• NVD entry