CVE-2023-1436 Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray
An attacker can cause a denial of service by triggering infinite recursion in the Jettison library when processing crafted JSON arrays.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1436?
CVE-2023-1436 is a medium-severity denial of service vulnerability in jettison, published on 16 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
Weakness: CWE-674
Which versions are affected by CVE-2023-1436?
2 open source packages ship an affected version, including org.codehaus.jettison:jettison. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.codehaus.jettison:jettison Maven | All versions | 1.5.4 |
org.codehaus.jettison:jettison Maven | All versions | 1.5.4 |
Linux distribution packages (2)
jettison openSUSE:Leap 15.4 | All versions | 1.5.4-150200.3.7.1 |
jettison openSUSE:Tumbleweed | All versions | 1.5.4-1.1 |
Products include Jettison Project Jettison.
How do I fix CVE-2023-1436?
Upgrade org.codehaus.jettison:jettison to 1.5.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-1436 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1436 exists.
Sources
Also known as CLEANSTART-2026-FW96675, DEBIAN-CVE-2023-1436, ECHO-c7a7-9448-f9f3, GHSA-q6g2-g7f3-rr83, OESA-2023-1963, OESA-2023-1964 and 7 more.