CVE-2023-1370: Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON
Vulnerability summary
CVE-2023-1370 is a high (CVSS 7.5) Uncontrolled Recursion vulnerability in json-smart_project json-smart. EPSS estimates a 1.12% chance of exploitation in the next 30 days, higher than 66.1% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 9Timeline
- 13-03-2023PublishedVulnerability first disclosed.
- 27-02-2025Last modifiedVulnerability information updated.
Description
[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.
CVSS metrics
8 scores · 8 sources · 1 version- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.12%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.12% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (research.jfrog.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard16 products
- celeborn-0.5< 0.5.4-r26
- celeborn-0.6< 0.6.3-r7
- druid< 37.0.0-r14 | < 34.0.0-r6 | < 37.0.0-r56
- elasticsearch-7< 7.17.14-r2
- hadoop-client-modules< 3.3.6-r7
Wolfi8 products
- celeborn-0.6< 0.6.3-r7
- druid< 37.0.0-r14 | < 34.0.0-r6 | < 37.0.0-r56
- sonarqube-10< 25.1.0.102122-r0
- thingsboard< 3.7-r4
- thingsboard-tb-js-executor< 3.7-r4
Debian1 product
- json-smart< 2.2-2+deb12u1 | < 2.2-3
Json-smart1 product
- json-smart< 2.4.9
Json-smart_project1 product
- json-smart< 2.4.9
Net.minidev1 product
- json-smart< 2.4.9
Redhat1 product
- jenkins-2-plugins< 0:4.10.1684982411-1.el8
Ubuntu1 product
- json-smart< 2.2-2ubuntu0.18.04.1 | < 2.2-2ubuntu0.20.04.1 | < 2.2-2ubuntu0.22.04.1
8 vendors · 30 products
