GitHub Advisoryadvisory · Maven

GHSA-2rwm-xv5j-777p Eclipse Parsson stack overflow when parsing deeply nested input

CRITICAL Published 2024-07-17 Modified 2024-11-18 Official page ↗
Aliases
CVE-2023-7272
Ecosystem
Maven
Packages
org.eclipse.parsson:parsson
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-787
Reviewed
2024-07-17

Affected packages

• Maven org.eclipse.parsson:parsson: >= 1.1.0, < 1.1.3 → fixed in 1.1.3 • Maven org.eclipse.parsson:parsson: < 1.0.4 → fixed in 1.0.4

Description

In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing (e.g. parse, generate, transform and query) JSON documents.

Related

Alias · CVE (1)

  • CVE-2023-7272 In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack… vulnerability

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References