Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

json-smart library may crash applications

published 26 days ago

Summary

The json-smart component used in Red Hat environments can run out of memory when it processes specially crafted JSON data that contains many opening braces. This can cause the application to stop responding, leading to a denial of service. Update to the released json-smart 2.5.0.rhlw-00001 version to fix the problem.

What to do

Update redhat net.minidev:json-smart to version 2.5.0.rhlw-00001.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat Lightwell:Maven	redhat	net.minidev:json-smart	< 2.5.0.rhlw-00001 Fix: upgrade to 2.5.0.rhlw-00001

Original advisory text

Lightwell Security Advisory: json-smart 2.5.0.rhlw-00001

Red Hat Lightwell has released net.minidev:json-smart 2.5.0.rhlw-00001 with a backported security fix.

CVE-2024-57699: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.

This patched artifact is a drop-in replacement for net.minidev:json-smart 2.5.0 from Maven Central.

References

https://nvd.nist.gov/vuln/detail/cve-2023-1370 Vendor Advisory
https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699 URL
https://nvd.nist.gov/vuln/detail/CVE-2024-57699 Vendor Advisory
https://github.com/advisories/GHSA-pq2g-wx69-c263 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published9 Oct 2026

Updated27 Oct 2026

First seen27 Oct 2026

Sources

RHLW-2026-90932e54c65972cd · OSV

Track software like this

Free during beta