Jettison vulnerable to infinite recursion

ALTO 7.5CVE-2023-1436 · GHSA-q6g2-g7f3-rr83 · Published 22/03/2023 · updated 17/06/2026

In breve

CVE-2023-1436 è una vulnerabilità ALTO (CVSS 7.5) che riguarda org.codehaus.jettison:jettison, jettison (jettison project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 63.2% delle vulnerabilità.
Correzione: aggiornare a 1.5.4 o successiva.

Package	Affected versions	Patched versions
org.codehaus.jettison:jettison Maven	`< 1.5.4`	`1.5.4`
jettison jettison_project	`< 1.5.4`	`1.5.4`

Description

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-1436 · ADVISORY
jettison-json/jettison · WEB
jettison-json/jettison#62 · WEB
jettison-json/jettison · PACKAGE
jettison-json/jettison release jettison-1.5.4 · WEB
research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911 · WEB
research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911 · Exploit

Altre vulnerabilità di org.codehaus.jettison:jettison

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.codehaus.jettison:jettison

Maven

< 1.5.4

1.5.4

jettison

jettison_project

< 1.5.4

1.5.4

Description

NVD description

Altre vulnerabilità di org.codehaus.jettison:jettison

Vedi tutto →