CVE-2023-33008 Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers numbers such as 1e20000000 that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result ...

Apache Johnzon 代码问题漏洞

Apache Johnzon is the United States Apache Apache company provides a JsonProcessing aka JSR-353 implementation of the project. A denial of service vulnerability exists in Apache Johnzon versions prior to 1.2.21, which stems from the program mishandling a large number of message requests and can b...

Apache Sling Commons JSON bundle vulnerable to Improper Input Validation

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The org.apache.sling.commons.json bundle has been...

CVE-2022-47937 Multiple parsing problems in the Apache Sling Commons JSON module

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to conside...

PT-2023-4628 · Apache · Apache Johnzon

Name of the Vulnerable Software and Affected Versions: Apache Johnzon versions 1.2.0 through 1.2.20 Description: A malicious attacker can craft JSON input that uses large numbers, such as 1e20000000, which Apache Johnzon will deserialize into BigDecimal. This may result in a slow conversion, posi...