CVE-2022-40150: Stack Buffer Overflow in Jettison
Vulnerability summary
CVE-2022-40150 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 1.65% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 3Timeline
- 16-09-2022PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.
CVSS metrics
7 scores · 7 sources · 1 version- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.65%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.65% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard2 products
- druid< 35.0.1-r0 | < 34.0.0-r6 | < 35.0.0-r0 | < 35.0.1-r5
- hadoop-fips-3.3.6All versions (No fix recorded)
Debian2 products
- libjettison-java< 1.5.3-1
- debian_linuxEOL10.0 | 11.0
Jettison1 product
- jettison≥ unspecified, ≤ 1.4.0
Jettison_project1 product
- jettison≤ 1.4.0
Org.codehaus.jettison1 product
- jettison< 1.5.2
Ubuntu1 product
- libjettison-java< 1.2-3ubuntu0.1~esm1 | < 1.4.0-1ubuntu0.18.04.1~esm1 | < 1.4.0-1ubuntu0.20.04.1 | < 1.4.1-1ubuntu0.22.04.1 | All versions (No fix recorded)
Wolfi1 product
- druid< 35.0.1-r0 | < 34.0.0-r6 | < 35.0.0-r0 | < 35.0.1-r5
7 vendors · 9 products
References
11 links- bugs.chromium.org/p/oss-fuzz/issues/detail?id=46549REPORTWEBIssue TrackingPermissions RequiredThird Party Advisory
lists.debian.org/debian-lts-announce/2022/12/msg00045.htmlMailing ListARTICLEWEBThird Party Advisory