CVE-2023-5072

Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

Score

CVSS 3.1 7.5 High

Status

Modified - cve-coordination@google.com

Published

2023-10-12

Last modified

2025-02-13

Weaknesses

CWE-770

Affected products

• Json-java (Stleary)

References

• http://www.openwall.com/lists/oss-security/2023/12/13/4
• https://github.com/stleary/JSON-java/issues/758
• https://github.com/stleary/JSON-java/issues/771
• https://security.netapp.com/advisory/ntap-20240621-0007/