CVE-2021-23900 Uncaught Exception leading to Denial of Service in json-sanitizer

High 7.5 Published 13 Jan 2021 Updated 3 Aug 2024

Crafted input causes invalid JSON output or exceptions in the json-sanitizer library, potentially leading to denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-23900?

CVE-2021-23900 is a high-severity denial of service vulnerability in n/a, published on 13 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.

Which versions are affected by CVE-2021-23900?

2 open source packages ship an affected version, including com.mikesamuel:json-sanitizer. It affects 1 product.

Package	Affected	Fixed in
`com.mikesamuel:json-sanitizer` Maven	All versions	`1.2.2`
`com.mikesamuel:json-sanitizer` Maven	All versions	`1.2.2`

Products include Owasp Json-Sanitizer.

How do I fix CVE-2021-23900?

Upgrade com.mikesamuel:json-sanitizer to 1.2.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-23900 being exploited?

There is no known exploitation of CVE-2021-23900 in the wild and no public exploit code.

Sources

Also known as GHSA-8rf5-92jh-3vc9.