GitHub Advisoryadvisory · Maven, Packagist, Go

GHSA-5wfc-hjrc-gq87 hjson stack exhaustion vulnerability

HIGH Published 2023-06-14 Modified 2026-05-20 Official page ↗
Aliases
CVE-2023-34620
Ecosystem
Maven, Packagist, Go
Packages
org.hjson:hjson, laktak/hjson, github.com/hjson/hjson-go/v4
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-674, CWE-787
Reviewed
2023-06-14

Affected packages

• Maven org.hjson:hjson: < 3.0.1 → fixed in 3.0.1 • Packagist laktak/hjson: < 2.3.0 → fixed in 2.3.0 • Go github.com/hjson/hjson-go/v4: < 4.5.0 → fixed in 4.5.0

Description

An issue was discovered hjson through 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.

Related

Alias · CVE (1)

  • CVE-2023-34620 An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that… vulnerability

Weakness · CWE (3)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-674 Uncontrolled Recursion weakness
  • CWE-787 Out-of-bounds Write weakness

References