CVE-2023-1370

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

22/03/2023

Last modified:

13/02/2025

Description

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.<br /> <br /> When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively.<br /> <br /> It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS v3.1 Severity and Metrics:

Base Score: 7.50 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): None
Availability (A): High