Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-1370

Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
JFROG

Description

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

json-smart json-smart

  • 0 to < 2.4.9affected

References