CVE-2023-42278 hutool Buffer Overflow vulnerability

What is CVE-2023-42278?

CVE-2023-42278 is a high-severity memory corruption vulnerability in n/a, published on 8 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().

Weakness: CWE-120

Which versions are affected by CVE-2023-42278?

4 open source packages ship an affected version, including cn.hutool:hutool-core and cn.hutool:hutool-json. It affects 1 product.

Products include Hutool Hutool.

How do I fix CVE-2023-42278?

Upgrade cn.hutool:hutool-core to 5.8.22 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-42278 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42278 exists.

Other vulnerabilities in n/a

• CVE-2023-42276 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-42277 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-24162 Dromara Hutool Deserialization of Untrusted Data vulnerability Critical 9.8
• CVE-2023-24163 Dromara hutool vulnerable to SQL Injection Critical 9.8
• CVE-2022-22885 Improper Certificate Validation in Hutool Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rr66-qh5m-w6mx.