CVE-2023-1370CWE-674

Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

High · published March 13, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
65.9
In the wild
Unconfirmed
What it is

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.

When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively.

It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01119 · 65.9th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2023-03-13T09:04Z
EPSS history
Timeline
  • 13 MAR 09:04Z
    Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON
    cvelistv5