Description
Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| https://github.com/stleary/JSON-java | — | ≤ 20230618 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jenkins-json +1 | No fix yet | — |
| Debian 14 | libjson-java | 3.1.0+dfsg-1 | — |
| Debian 13 | jenkins-json +1 | No fix yet | — |
| Debian 13 | libjson-java | 3.1.0+dfsg-1 | — |
| Debian 12 | jenkins-json +2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jenkins-json +2 | No fix yet | — |
| Ubuntu 26.04 LTS | jenkins-json +2 | No fix yet | — |
| Ubuntu 25.10 | jenkins-json +2 | No fix yet | — |
| Ubuntu 24.04 LTS | jenkins-json +2 | No fix yet | — |
| Ubuntu 22.04 LTS | jenkins-json +1 | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jenkins-json +1 | No fix yet | — |
| Ubuntu 18.04 LTS | jenkins-json +1 | No fix yet | — |
| Ubuntu 16.04 LTS | jenkins-json +1 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | libjettison-java | No fix yet | — |
| Ubuntu Pro 20.04 LTS | libjettison-java | No fix yet | — |
| Ubuntu Pro 18.04 LTS | libjettison-java | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libjettison-java | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openjdk17 | 17.0.10_p7-r0 | — |
| Alpine v3.24 | openjdk21 | 21.0.2_p13-r0 | — |
| Alpine v3.23 | openjdk17 | 17.0.10_p7-r0 | — |
| Alpine v3.23 | openjdk21 | 21.0.2_p13-r0 | — |
| Alpine v3.22 | openjdk17 | 17.0.10_p7-r0 | — |
| Alpine v3.22 | openjdk21 | 21.0.2_p13-r0 | — |
| Alpine v3.21 | openjdk17 | 17.0.10_p7-r0 | — |
| Alpine v3.21 | openjdk21 | 21.0.2_p13-r0 | — |
| Alpine v3.20 | openjdk17 | 17.0.10_p7-r0 | — |
| Alpine v3.20 | openjdk21 | 21.0.2_p13-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openjdk17 | 17.0.10_p7-r0 | — |
| Alpine v3.19 | openjdk21 | 21.0.2_p13-r0 | — |
| Alpine v3.18 | openjdk17 | 17.0.10_p7-r0 | — |
| Alpine v3.17 | openjdk17 | 17.0.10_p7-r0 | — |
| Alpine v3.16 | openjdk17 | 17.0.10_p7-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.json:json | < 20231013 | 20231013 | GHSA-4jq9-2xhw-jpx7 |
Advisories 33
- WID-SEC-2023-3037 Apache Camel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 5, 2026
- WID-SEC-2024-1637 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- WID-SEC-2024-0123 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 7, 2026
- WID-SEC-2023-3070 Red Hat JBoss A-MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 16, 2025
- WID-SEC-2024-0121 Oracle Java SE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 29, 2025
- WID-SEC-2025-1989 SAP Patchday September 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2025
- WID-SEC-2024-0869 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2025
- NCSC-2025-0275 Kwetsbaarheden verholpen in SAP producten NCSC-NL (Netherlands) · Sep 9, 2025
- WID-SEC-2024-0899 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2025
- WID-SEC-2024-0521 IBM MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 15, 2024
- WID-SEC-2024-0671 Atlassian Jira Software: Mehrere Schwachstellen ermöglichen Codeausführung und DoS BSI CERT-Bund (WID) · Nov 24, 2024
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3218 Oracle Systems: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-1728 IBM InfoSphere Information Server: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jul 30, 2024
- NCSC-2024-0305 Kwetsbaarheden verholpen in Oracle Siebel CRM NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0298 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1653 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-0868 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0898 Oracle Health Sciences Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0885 Oracle Database Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0873 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0871 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2023-3152 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 20, 2024
- WID-SEC-2024-0101 Atlassian Bitbucket: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 20, 2024
- WID-SEC-2024-0106 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0105 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0124 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0122 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0118 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0108 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0107 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0094 Atlassian Bamboo: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 15, 2024
- WID-SEC-2023-3159 IBM MQ: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Dec 14, 2023