Skip to content
OpenAdvisories
High · 7.5 CVE-2023-1370 EUVD-2023-0861GHSA-493p-pfq6-5258

Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

Published Mar 13, 2023 · Updated Feb 27, 2025 · Assigned by JFROG

Vendor: json-smart Product: json-smart Package: celeborn-0.6 Package: druid Package: json-smart Package: json-smart Package: net.minidev:json-smart Package: sonarqube-10 Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.

When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively.

It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

Affected products

VendorProductAffectedFixed
json-smart json-smart < 2.4.9 2.4.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 json-smart 2.2-3 —
Debian 13 json-smart 2.2-3 —
Debian 12 json-smart 2.2-2+deb12u1 —
Debian 10 json-smart 2.2-2+deb10u1 DLA-3373-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS json-smart 2.2-2ubuntu0.22.04.1 USN-6011-1
Ubuntu 20.04 LTS json-smart 2.2-2ubuntu0.20.04.1 USN-6011-1
Ubuntu 18.04 LTS json-smart 2.2-2ubuntu0.18.04.1 USN-6011-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 jenkins-2-plugins 4.10.1684982411-1.el8 RHSA-2023:3362
Red Hat Ocp Tools 4 jenkins 2.401.1.1686649641-3.el8 RHSA-2023:3663, RHSA-2023:3622, RHSA-2023:3610
Red Hat Ocp Tools 4 jenkins-2-plugins 4.11.1686831822-1.el8 RHSA-2023:3663, RHSA-2023:3622, RHSA-2023:3610

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling celeborn-0.6 0.6.3-r7 —
Wolfi rolling druid 34.0.0-r6 —
Wolfi rolling sonarqube-10 25.1.0.102122-r0 —
Wolfi rolling thingsboard +4 3.7-r4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven net.minidev:json-smart < 2.4.9 2.4.9 GHSA-493p-pfq6-5258

Advisories 36

References