CVE-2023-5072 DoS Vulnerability in JSON-Java
An attacker can cause a denial of service by sending a small input string that triggers excessive memory consumption in the JSON-Java parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-5072?
CVE-2023-5072 is a high-severity denial of service vulnerability in https://github.com/stleary/JSON-java n/a, published on 12 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.
Weakness: CWE-770
Which versions are affected by CVE-2023-5072?
2 open source packages ship an affected version, including org.json:json. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.json:json Maven | All versions | 20231013 |
org.json:json Maven | All versions | 20231013 |
Products include Stleary Json-Java.
How do I fix CVE-2023-5072?
Upgrade org.json:json to 20231013 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-5072 being exploited?
There is no known exploitation of CVE-2023-5072 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-RW83573, CLSA-2025-1761091596, CLSA-2025-1761177997, DEBIAN-CVE-2023-5072, ECHO-8c7a-7f94-5491, GHSA-4jq9-2xhw-jpx7 and 3 more.