JSON CVEs

39 CVEs, 1 exploited, 6 protected by Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 39 matches · 6 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5

39matches 6protected15.4% 1exploited2.6% 0CISA KEV0.0% 2public PoC5.1% 0EPSS ≥ 0.50.0%

Protected by Waratek 6 15.4% Rule in development 0 0.0% Mitigation candidate 1 2.6% No exploit published 32 82.1%

Critical 7 17.9% High 22 56.4% Medium 10 25.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 6 15.4% partly blocked 0 0.0% not blocked 33 84.6% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 2.6% Working exploit published 0 0.0% Proof of concept only 19 48.7% Forecast only 0 0.0% No public exploit 19 48.7%

split by StatusSeverityProtectionExploit maturity peak 18 / year

20182 No exploit published2 High2 not blocked2 No public exploit2 20191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20203 Protected by Waratek2 No exploit published1 Critical1 High1 Medium1 blocked by ARMR today2 not blocked1 No public exploit3 20214 Protected by Waratek2 No exploit published2 Critical1 High2 Medium1 blocked by ARMR today2 not blocked2 No public exploit4 20224 Mitigation candidate1 No exploit published3 Critical1 High3 not blocked4 Proof of concept only4 202318 No exploit published18 Critical3 High12 Medium3 not blocked18 Proof of concept only12 No public exploit6 20241 No exploit published1 Medium1 not blocked1 No public exploit1 20251 No exploit published1 Medium1 not blocked1 Proof of concept only1 20265 Protected by Waratek1 No exploit published4 Critical1 High1 Medium3 blocked by ARMR today1 not blocked4 Exploited1 Proof of concept only2 No public exploit2

201820192020202120222023202420252026

39 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2026-59171	Medium	2026-11-06	No exploit published	Proof of concept only	JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.
CVE-2026-16723	Critical	2026-07-23	Protected by Waratek	Exploited	A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVE-2026-34481	Medium	2026-04-10	No exploit published	No public exploit	Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.
CVE-2026-33013	High	2026-03-20	No exploit published	Proof of concept only	Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.
CVE-2026-24802	Medium	2026-01-27	No exploit published	No public exploit	Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java. This issue affects jsonrpc4j: through 1.6.0.
CVE-2025-3588	Medium	2025-04-14	No exploit published	Proof of concept only	A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function apply of the file org/jsonschema2pojo/rules/SchemaRule.java of the component JSON File Handler. The manipulation leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-47855	Medium	2024-10-04	No exploit published	No public exploit	util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.
CVE-2023-51074	Medium	2023-12-27	No exploit published	No public exploit	json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.
CVE-2023-50773	Medium	2023-12-13	No exploit published	No public exploit	Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVE-2023-50772	Medium	2023-12-13	No exploit published	No public exploit	Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVE-2023-49145	High	2023-11-27	No exploit published	No public exploit	Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.
CVE-2023-5072	High	2023-10-12	No exploit published	No public exploit	Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.
CVE-2023-42278	High	2023-09-08	No exploit published	Proof of concept only	hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
CVE-2023-42277	Critical	2023-09-08	No exploit published	Proof of concept only	hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.
CVE-2023-42276	Critical	2023-09-08	No exploit published	Proof of concept only	hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.
CVE-2023-39685	High	2023-09-01	No exploit published	Proof of concept only	An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.
CVE-2023-35110	High	2023-06-14	No exploit published	Proof of concept only	An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVE-2023-34620	High	2023-06-14	No exploit published	Proof of concept only	An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVE-2023-34616	High	2023-06-14	No exploit published	Proof of concept only	An issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVE-2023-34615	High	2023-06-14	No exploit published	Proof of concept only	An issue was discovered JSONUtil thru 5.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVE-2023-34614	High	2023-06-14	No exploit published	Proof of concept only	An issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVE-2023-34612	High	2023-06-14	No exploit published	Proof of concept only	An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVE-2023-34610	High	2023-06-14	No exploit published	Proof of concept only	An issue was discovered json-io thru 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVE-2022-47937	Critical	2023-05-15	No exploit published	No public exploit	Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.
CVE-2023-1370	High	2023-03-22	No exploit published	Proof of concept only	[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.
CVE-2022-45690	High	2022-12-13	No exploit published	Proof of concept only	A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
CVE-2022-45689	High	2022-12-13	No exploit published	Proof of concept only	hutool-json v5.8.10 was discovered to contain an out of memory error.
CVE-2022-45688	High	2022-12-13	No exploit published	Proof of concept only	A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
CVE-2022-25845	Critical	2022-06-10	Mitigation candidate	Proof of concept only	The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVE-2021-31684	High	2021-06-01	No exploit published	No public exploit	A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.
CVE-2021-27568	Medium	2021-02-23	Protected by Waratek	No public exploit	An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
CVE-2021-23900	High	2021-01-13	No exploit published	No public exploit	OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.
CVE-2021-23899	Critical	2021-01-13	Protected by Waratek	No public exploit	OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
CVE-2020-7712	High	2020-08-30	Protected by Waratek	No public exploit	This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
CVE-2020-13973	Medium	2020-06-09	No exploit published	No public exploit	OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.
CVE-2018-21234	Critical	2020-05-21	Protected by Waratek	No public exploit	Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
CVE-2019-0188	High	2019-05-28	Protected by Waratek	No public exploit	Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
CVE-2018-18854	High	2018-10-31	No exploit published	No public exploit	Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).
CVE-2018-18853	High	2018-10-31	No exploit published	No public exploit	Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2026-59171

Medium

2026-11-06

No exploit published

Proof of concept only

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.

CVE-2026-16723

Critical

2026-07-23

Protected by Waratek

Exploited

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

CVE-2026-34481

Medium

2026-04-10

No exploit published

No public exploit

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.

CVE-2026-33013

High

2026-03-20

No exploit published

Proof of concept only

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.

CVE-2026-24802

Medium

2026-01-27

No exploit published

No public exploit

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java. This issue affects jsonrpc4j: through 1.6.0.

CVE-2025-3588

Medium

2025-04-14

No exploit published

Proof of concept only

A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function apply of the file org/jsonschema2pojo/rules/SchemaRule.java of the component JSON File Handler. The manipulation leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2024-47855

Medium

2024-10-04

No exploit published

No public exploit

util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.

CVE-2023-51074

Medium

2023-12-27

No exploit published

No public exploit

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

CVE-2023-50773

Medium

2023-12-13

No exploit published

No public exploit

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

CVE-2023-50772

Medium

2023-12-13

No exploit published

No public exploit

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

CVE-2023-49145

High

2023-11-27

No exploit published

No public exploit

Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.

CVE-2023-5072

High

2023-10-12

No exploit published

No public exploit

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

CVE-2023-42278

High

2023-09-08

No exploit published

Proof of concept only

hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().

CVE-2023-42277

Critical

2023-09-08

No exploit published

Proof of concept only

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.

CVE-2023-42276

Critical

2023-09-08

No exploit published

Proof of concept only

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.

CVE-2023-39685

High

2023-09-01

No exploit published

Proof of concept only

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.

CVE-2023-35110

High

2023-06-14

No exploit published

Proof of concept only

An issue was discovered jjson thru 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

CVE-2023-34620

High

2023-06-14

No exploit published

Proof of concept only

An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

CVE-2023-34616

High

2023-06-14

No exploit published

Proof of concept only

An issue was discovered pbjson thru 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

CVE-2023-34615

High

2023-06-14

No exploit published

Proof of concept only

An issue was discovered JSONUtil thru 5.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

CVE-2023-34614

High

2023-06-14

No exploit published

Proof of concept only

An issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

CVE-2023-34612

High

2023-06-14

No exploit published

Proof of concept only

An issue was discovered ph-json thru 9.5.5 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

CVE-2023-34610

High

2023-06-14

No exploit published

Proof of concept only

An issue was discovered json-io thru 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

CVE-2022-47937

Critical

2023-05-15

No exploit published

No public exploit

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.

CVE-2023-1370

High

2023-03-22

No exploit published

Proof of concept only

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

CVE-2022-45690

High

2022-12-13

No exploit published

Proof of concept only

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

CVE-2022-45689

High

2022-12-13

No exploit published

Proof of concept only

hutool-json v5.8.10 was discovered to contain an out of memory error.

CVE-2022-45688

High

2022-12-13

No exploit published

Proof of concept only

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

CVE-2022-25845

Critical

2022-06-10

Mitigation candidate

Proof of concept only

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

CVE-2021-31684

High

2021-06-01

No exploit published

No public exploit

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request.

CVE-2021-27568

Medium

2021-02-23

Protected by Waratek

No public exploit

An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.

CVE-2021-23900

High

2021-01-13

No exploit published

No public exploit

OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.

CVE-2021-23899

Critical

2021-01-13

Protected by Waratek

No public exploit

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.

CVE-2020-7712

High

2020-08-30

Protected by Waratek

No public exploit

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

CVE-2020-13973

Medium

2020-06-09

No exploit published

No public exploit

OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.

CVE-2018-21234

Critical

2020-05-21

Protected by Waratek

No public exploit

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.

CVE-2019-0188

High

2019-05-28

Protected by Waratek

No public exploit

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.

CVE-2018-18854

High

2018-10-31

No exploit published

No public exploit

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).

CVE-2018-18853

High

2018-10-31

No exploit published

No public exploit

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits.