hjson stack exhaustion vulnerability

HIGH 7.5CVE-2023-34620 · GHSA-5wfc-hjrc-gq87 · GO-2026-5157 · Published 14/06/2023 · updated 17/06/2026

In short

CVE-2023-34620 is a HIGH (CVSS 7.5) vulnerability affecting github.com/hjson/hjson-go, github.com/hjson/hjson-go/v4, org.hjson:hjson.
Chance of exploitation in the next 30 days (EPSS): 0.78%, higher than 56.1% of all vulnerabilities.
Fix: update to 4.5.0, 3.0.1, 2.3.0 or later.

Package	Affected versions	Patched versions
github.com/hjson/hjson-go Go	`all versions`	No fix yet
github.com/hjson/hjson-go/v4 Go	`< 4.5.0`	`4.5.0`
org.hjson:hjson Maven	`< 3.0.1`	`3.0.1`
laktak/hjson Packagist	`< 2.3.0`	`2.3.0`
hjson hjson_project	`≤ 3.0.0`	No fix yet

Description

An issue was discovered hjson through 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.

NVD description

An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

References

nvd.nist.gov/vuln/detail/CVE-2023-34620 · ADVISORY
hjson/hjson-java · WEB
hjson/hjson-cpp#54 · WEB
hjson/hjson-go#67 · WEB
hjson/hjson-php#45 · WEB
hjson/hjson-go commit 326599c · WEB
hjson/hjson-php commit 2d1b8b4 · WEB
GitHub Advisory GHSA-5wfc-hjrc-gq87 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free