Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Eclipse Parsson can crash with deeply nested JSON

CVE-2023-7272 · published 2 years ago
Summary

The Eclipse Parsson library used for reading and writing JSON can run out of memory when it processes documents that contain many levels of nested objects. This may cause the application to stop working and deny service to users. Updating to version 1.0.4 or later (or 1.1.3 or later) removes the risk.

What to do
  • Update eclipse org.eclipse.parsson:parsson to version 1.1.3.
  • Update eclipse org.eclipse.parsson:parsson to version 1.0.4.
Affected software
Ecosystem VendorProductAffected versions
maven eclipse org.eclipse.parsson:parsson >= 1.1.0, < 1.1.3
< 1.0.4
Fix: upgrade to 1.1.3
– eclipse parsson < 1.0.4
>= 1.1.0, < 1.1.3
cpe:2.3:a:eclipse:parsson:*:*:*:*:*:*:*:*
Original advisory text
Eclipse Parsson stack overflow with deeply nested objects
In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing (e.g. parse, generate, transform and query) JSON documents.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published17 Jul 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-2rwm-xv5j-777p · GHSA
CVE-2023-7272 · NVD
CVE-2023-7272 · OSV
Track software like this
Free during beta