Description
Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by multiple parties because Janino is not intended for use with untrusted input.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | janino | 3.1.12+dfsg-1 | — |
| Debian 13 | janino | 3.1.12+dfsg-1 | — |
| Debian 12 | janino | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | janino | 3.1.10-150200.3.7.1 | SUSE-SU-2023:3385-1 |
| openSUSE Leap 15.4 | janino | 3.1.10-150200.3.7.1 | SUSE-SU-2023:3385-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | janino +3 | 3.1.7-1.amzn2023.0.2 | ALAS2023-2023-266 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.codehaus.janino:janino-parent | <= 3.1.9 | — | GHSA-gcg6-xv4f-f749 |
Advisories 4
- SUSE-SU-2023:3385-1 Security update for janino SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3684 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2024
- WID-SEC-2024-1769 Hitachi Ops Center: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Aug 5, 2024
- ALAS2023-2023-266 Moderate: janino security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 26, 2023