CVE-2022-45688 json stack overflow vulnerability

What is CVE-2022-45688?

CVE-2022-45688 is a high-severity denial of service vulnerability in n/a, published on 13 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Weakness: CWE-787

Which versions are affected by CVE-2022-45688?

4 open source packages ship an affected version, including cn.hutool:hutool-json and org.json:json. It affects 2 products.

Products include Hutool Hutool, Stleary Json-Java.

How do I fix CVE-2022-45688?

Upgrade cn.hutool:hutool-json to 5.8.25 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-45688 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45688 exists.

Public exploit code: 5 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-42276 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-42277 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-24162 Dromara Hutool Deserialization of Untrusted Data vulnerability Critical 9.8
• CVE-2023-24163 Dromara hutool vulnerable to SQL Injection Critical 9.8
• CVE-2022-22885 Improper Certificate Validation in Hutool Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2025-1760313982, CLSA-2025-1760313984, GHSA-3vqj-43w4-2q58, RHLW-2026-1da18ff8e343fdf8, ROOT-APP-MAVEN-CVE-2022-45688, openSUSE-SU-2024:14371-1.