CVE-2022-40149

MEDIUM

jettison < 1.4.0 - Denial of Service via Stack Overflow in XML/JSON Parser

Title source: llm

Description

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

References (4)

Core 4

Core References

Permissions Required, Third Party Advisory

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538

Issue Tracking, Third Party Advisory

https://github.com/jettison-json/jettison/issues/45

Mailing List, Third Party Advisory mailing-list

https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html

Third Party Advisory vendor-advisory

https://www.debian.org/security/2023/dsa-5312

Scores

CVSS v3 6.5

EPSS 0.0055

EPSS Percentile 68.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-121 CWE-787

Status published

Products (4)

debian/debian_linux 10.0

debian/debian_linux 11.0

jettison_project/jettison < 1.4.0

org.codehaus.jettison/jettison 0 - 1.5.1Maven

Published Sep 16, 2022

Tracked Since Feb 18, 2026