CVE-2022-40149: Stack Buffer Overflow in Jettison
Vulnerability summary
CVE-2022-40149 is a high (CVSS 7.5) Stack-based Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.9% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 3Timeline
- 16-09-2022PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CVSS metrics
7 scores · 7 sources · 1 version- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
1.68%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.68% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard2 products
- druid< 35.0.0-r0 | < 35.0.1-r5 | < 34.0.0-r6 | < 35.0.1-r0
- hadoop-fips-3.3.6All versions (No fix recorded)
Debian2 products
- libjettison-java< 1.4.0-1+deb10u1 | < 1.5.1-1
- debian_linuxEOL10.0 | 11.0
Jettison1 product
- jettison≥ unspecified, ≤ 1.4.0
Jettison_project1 product
- jettison≤ 1.4.0
Org.codehaus.jettison1 product
- jettison< 1.5.1
Ubuntu1 product
- libjettison-java< 1.2-3ubuntu0.1~esm1 | < 1.4.0-1ubuntu0.18.04.1~esm1 | < 1.4.0-1ubuntu0.20.04.1 | < 1.4.1-1ubuntu0.22.04.1 | All versions (No fix recorded)
Wolfi1 product
- druid< 35.0.0-r0 | < 35.0.1-r5 | < 34.0.0-r6 | < 35.0.1-r0
7 vendors · 9 products
References
13 links- bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538REPORTWEBPermissions RequiredThird Party Advisory
lists.debian.org/debian-lts-announce/2022/11/msg00011.htmlMailing ListARTICLEWEBThird Party Advisory