Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.
Product
debian/libjson-java vulnerabilities
2 published CVES affecting debian/libjson-java, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 2
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest debian/libjson-java CVEs
Newest publication first
-
HighCVSS 7.5
-
MediumCVSS 5.3
util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.