CVE-2022-40150

MEDIUM

jettison < 1.4.0 - Denial of Service via Uncontrolled Recursion

Title source: llm

Description

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.

References (4)

Core 4

Core References

Issue Tracking, Permissions Required, Third Party Advisory

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46549

Issue Tracking, Third Party Advisory

https://github.com/jettison-json/jettison/issues/45

Mailing List, Third Party Advisory mailing-list

https://lists.debian.org/debian-lts-announce/2022/12/msg00045.html

Third Party Advisory vendor-advisory

https://www.debian.org/security/2023/dsa-5312

Scores

CVSS v3 6.5

EPSS 0.0119

EPSS Percentile 63.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-674 CWE-400

Status published

Products (4)

debian/debian_linux 10.0

debian/debian_linux 11.0

jettison_project/jettison < 1.4.0

org.codehaus.jettison/jettison 0 - 1.5.2Maven

Published Sep 16, 2022

Tracked Since Feb 18, 2026