CVE-2022-45690 hutool-json stack overflow vulnerability

What is CVE-2022-45690?

CVE-2022-45690 is a high-severity denial of service vulnerability in n/a, published on 13 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Weakness: CWE-787

Which versions are affected by CVE-2022-45690?

2 open source packages ship an affected version, including cn.hutool:hutool-json. It affects 2 products.

Products include Hutool Hutool, Stleary Json-Java.

How do I fix CVE-2022-45690?

Upgrade cn.hutool:hutool-json to 5.8.11 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-45690 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45690 exists.

Other vulnerabilities in n/a

• CVE-2023-42276 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-42277 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-24162 Dromara Hutool Deserialization of Untrusted Data vulnerability Critical 9.8
• CVE-2023-24163 Dromara hutool vulnerable to SQL Injection Critical 9.8
• CVE-2022-22885 Improper Certificate Validation in Hutool Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-whgh-g24c-3j5q.