CVE-2022-3433

MEDIUM

aeson < 2.0.1.0 - Denial of Service via Hash Collision in JSON Input

Title source: llm
STIX 2.1

Description

The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.

References (1)

Core 1
Core References
Exploit, Patch, Technical Description, Third Party Advisory
https://cs-syd.eu/posts/2021-09-11-json-vulnerability

Scores

CVSS v3 6.5
EPSS 0.0071
EPSS Percentile 48.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-326 CWE-328
Status published
Products (1)
haskell/aeson < 2.0.1.0
Published Oct 10, 2022
Tracked Since Feb 18, 2026