Skip to content
OpenAdvisories
High · 7.5 CVE-2024-57699 EUVD-2024-53713GHSA-pq2g-wx69-c263

Netplex Json-smart Uncontrolled Recursion vulnerability

Published Feb 5, 2025 · Updated Feb 6, 2025 · Assigned by mitre

Package: akhq Package: apache-nifi Package: apache-nifi-compat Package: apache-nifi-toolkit Package: apicurio-registry Package: apicurio-registry-nginx-config Package: apicurio-registry-ui Package: dependency-track Package: dependency-track-bundled Package: json-smart Package: json-smart Package: net.minidev:json-smart Package: opensearch-2 Package: sonarqube-10 Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 json-smart 2.5.2-1 —
Debian 13 json-smart 2.5.2-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 json-smart No fix yet —
Ubuntu 26.04 LTS json-smart No fix yet —
Ubuntu 25.10 json-smart No fix yet —
Ubuntu 24.04 LTS json-smart No fix yet —
Ubuntu 22.04 LTS json-smart No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS json-smart No fix yet —
Ubuntu 18.04 LTS json-smart No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Ocp Tools 4 jenkins 2.504.2.1750846524-3.el9 RHSA-2025:10120, RHSA-2025:10119, RHSA-2025:10118
Red Hat Ocp Tools 4 jenkins-2-plugins 4.12.1750933270-1.el8 RHSA-2025:10120, RHSA-2025:10119, RHSA-2025:10118

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.25.1-r3 —
Wolfi rolling apache-nifi +2 2.3.0-r0 —
Wolfi rolling apicurio-registry +2 3.0.6-r1 —
Wolfi rolling dependency-track +1 4.13.0-r1 —
Wolfi rolling opensearch-2 2.19.4-r0 —
Wolfi rolling sonarqube-10 No fix yet —
Wolfi rolling trino +58 471-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven net.minidev:json-smart >= 2.5.0, < 2.5.2 2.5.2 GHSA-pq2g-wx69-c263

Advisories 37

References