RUSTSEC-2024-0012 Stack overflow during recursive JSON parsing

When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth...

@zemble/node (>=0.0.11, <=0.0.14), waku (>=0.19.0-alpha.2, <=0.19.1) potentially affected by CVE-2024-23340 via @hono/node-server (>=1.3.3, <=1.4.0)

@hono/node-server NPM version =1.3.3, =0.0.11, =0.19.0-alpha.2, =0.19.1 Source cves: CVE-2024-23340 Source advisory: OSV:GHSA-RJQ5-W47X-X359...

DEBIAN-CVE-2024-0232

A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service...

PT-2024-15399 · Sqlite · Sqlite

Name of the Vulnerable Software and Affected Versions: SQLite affected versions not specified Description: A heap use-after-free issue has been identified in the jsonParseAddNodeArray function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious...

OESA-2023-1965 jettison security update

Jettison is a collection of Java APIs like STaX and DOM which read and write JSON. This allows nearly transparent enablement of JSON based web services in services frameworks like CXF or XML serialization frameworks like XStream. Security Fixes: Those using Jettison to parse untrusted XML or JSON...

GHSA-G8P6-P27C-52FX Eclipse Parsson Denial of Service vulnerability

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processi...

Eclipse Parsson Denial of Service vulnerability

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processi...

CVE-2023-4043

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processi...

Input validation

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processi...

CVE-2023-4043

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processi...

CVE-2023-4043

CVE-2023-4043 affects Eclipse Parsson prior to 1.1.4 and 1.0.5. The root cause is a DoS in JSON number parsing when handling very large numbers, due to edge cases in the Java BigDecimal parsing path. The issue can be triggered by specially crafted input and can lead to much longer processing time...

PT-2023-27449 · Eclipse · Eclipse Parsson

Name of the Vulnerable Software and Affected Versions: Eclipse Parsson versions prior to 1.1.4 Eclipse Parsson versions prior to 1.0.5 Description: Parsing JSON from untrusted sources can lead to exploitation due to edge cases in Java's built-in support for parsing numbers with large scales,...

Eclipse Parsson Security Vulnerability

Eclipse Parsson is an implementation of the Jakarta JSON processing specification from the Eclipse Foundation. A security vulnerability exists in Eclipse Parsson versions prior to 1.1.4 that stems from parsing JSON from untrusted sources...

CVE-2023-32722

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbxjsonopen...

CVE-2023-32722

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbxjsonopen...

CVE-2023-32722

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbxjsonopen...

CVE-2023-32722

CVE-2023-32722 corresponds to a buffer overflow in the zabbix zbxjson module when parsing JSON via zbx_json_open. Reports from multiple sources confirm the issue affects Zabbix components and can lead to memory corruption, with Debian security advisories listing it among tracked CVEs for zabbix o...

CVE-2023-32722 Stack-buffer Overflow in library module zbxjson

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbxjsonopen...

SUSE-SU-2023:4000-1 Security update for yq

This update for yq fixes the following issues: yq was updated to 4.35.2 bsc1215808: Fixed number parsing as float bug in JSON 1756 Fixed string, null concatenation consistency 1712 Fixed expression parsing issue 1711 Update to 4.35.1: Added Lua output support Added BSD checksum format Update to...

g-http-java-client:JsonObjectParserFuzzer: Security exception in com.google.api.client.json.JsonParser.parseArray

Detailed Report: https://oss-fuzz.com/testcase?key=4942512319758336 Project: g-http-java-client Fuzzing Engine: libFuzzer Fuzz Target: JsonObjectParserFuzzer Job Type: libfuzzerasang-http-java-client Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...