hson-java vulnerable to denial of service

HIGH 7.5CVE-2023-39685 · GHSA-94w5-rf69-2h6c · Published 01/09/2023 · updated 17/06/2026

In short

CVE-2023-39685 is a HIGH (CVSS 7.5) vulnerability affecting org.hjson:hjson, hjson (hjson).
Chance of exploitation in the next 30 days (EPSS): 0.89%, higher than 59.6% of all vulnerabilities.
Fix: update to 3.0.1 or later.

Package	Affected versions	Patched versions
org.hjson:hjson Maven	`< 3.0.1`	`3.0.1`
hjson hjson	`≤ 3.0.0`	No fix yet

Description

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string to string a StringIndexOutOfBoundsException.

NVD description

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.

References

nvd.nist.gov/vuln/detail/CVE-2023-39685 · ADVISORY
hjson/hjson-java · WEB
hjson/hjson-java commit aff0b60 · WEB
hjson/hjson-java · PACKAGE

More vulnerabilities in org.hjson:hjson

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free