CVE-2023-34610 json-io vulnerable to stack exhaustion
Attackers can cause denial of service in json-io library by sending crafted objects with cyclic dependencies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34610?
CVE-2023-34610 is a high-severity denial of service vulnerability in n/a, published on 14 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered json-io thru 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
Weakness: CWE-787
Which versions are affected by CVE-2023-34610?
2 open source packages ship an affected version, including com.cedarsoftware:json-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.cedarsoftware:json-io Maven | All versions | 4.14.1 |
com.cedarsoftware:json-io Maven | All versions | 4.14.1 |
Products include Json-Io Project Json-Io.
How do I fix CVE-2023-34610?
Upgrade com.cedarsoftware:json-io to 4.14.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-34610 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34610 exists.
Sources
Also known as CLSA-2026-1774398090, GHSA-779h-3r69-4f5p.