hutool-json stack overflow vulnerability

높음 7.5CVE-2022-45690 · GHSA-whgh-g24c-3j5q · Published 13/12/2022 · updated 17/06/2026

요약

CVE-2022-45690은(는) cn.hutool:hutool-json, hutool (hutool), json-java (stleary)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.0%, 전체 취약점의 63.0%보다 높음.
조치: 5.8.11, 20220320 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
cn.hutool:hutool-json Maven	`< 5.8.11`	`5.8.11`
hutool hutool	`< 5.8.11`	`5.8.11`
json-java stleary	`< 20220320`	`20220320`

Description

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

NVD description

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

References

nvd.nist.gov/vuln/detail/CVE-2022-45690 · ADVISORY
dromara/hutool · WEB
stleary/JSON-java · WEB
stleary/JSON-java commit 7a124d8 · WEB
dromara/hutool · PACKAGE

cn.hutool:hutool-json의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cn.hutool:hutool-json

Maven

< 5.8.11

5.8.11

hutool

< 5.8.11

5.8.11

json-java

stleary

< 20220320

20220320

Description

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

NVD description

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

cn.hutool:hutool-json의 다른 취약점

모두 보기 →