RHLW-2026-1DA18FF8E343FDF8 Lightwell Security Advisory: json 20220320.0.0.rhlw-00003

Red Hat Lightwell has released org.json:json 20220320.0.0.rhlw-00003 with a backported security fix. CVE-2022-45688: A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service DoS via crafted JSON or XML data. This patched artifact is a...

ROOT-APP-MAVEN-GHSA-RM7J-F5G5-27VV GHSA-rm7j-f5g5-27vv in org.json:json - Patched by Root

Root has patched GHSA-rm7j-f5g5-27vv in the org.json:json package for Root:Maven. Multiple fixed versions available...

PT-2026-80688

Root has patched GHSA-rm7j-f5g5-27vv in the org.json:json package for Root:Maven. Multiple fixed versions available...

PT-2026-73591

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.2...

PT-2026-73575

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20090211-tuxcare.1...

PT-2026-73573

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.1...

PT-2026-73592

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20090211-tuxcare.3...

DoS (Denial of Service) org.json:json Dependency in Jira Software Data Center and Server

This High severity org.json:json Dependency vulnerability was introduced in versions 8.20.0, 8.22.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 9.7.0, 9.8.0, 9.9.0, 9.10.0, 9.11.0, and 9.12.0 of Jira Software Data Center and Server. This org.json:json Dependency vulnerability, with a CVSS...

DoS (Denial of Service) org.json:json Dependency in Jira Software Data Center and Server

This High severity org.json:json Dependency vulnerability was introduced in versions 8.20.0, 8.22.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 9.7.0, 9.8.0, and 9.9.0 of Jira Software Data Center and Server. This org.json:json Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS...

DoS (Denial of Service) org.json:json Dependency in Confluence Data Center and Server

This High severity org.json:json Dependency vulnerability was introduced in versions 3.0 of Confluence Data Center and Server. This org.json:json Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker...

DoS (Denial of Service) org.json:json Dependency in Bamboo Data Center and Server

This High severity org.json:json Dependency vulnerability was introduced in versions 9.2.3, 9.3.0, and 9.4.0 of Bamboo Data Center and Server. This org.json:json Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

asia.ivity:tiledscrollview (>=1.0, <=1.1.1), be.billington.android.light-sensitive-color:demo (1.0.1) +1874 more potentially affected by CVE-2023-5072 via org.json:json (20080701)

org.json:json MAVEN version 20080701 is affected by a known vulnerability. The following packages have a transitive dependency on org.json:json and may be impacted: - asia.ivity:tiledscrollview =1.0, =1.0.1, =0.1, =0.1, =3.0.0, =1.2.0-0, =1.2.0-0, =1.2.1-0 - br.eti.kinoshita:selenium2-base 0.1 an...

ai.idylnlp:idylnlp-models-deeplearning (>=1.0.0, <=1.1.0), ai.idylnlp:idylnlp-models-opennlp (1.1.0) +698 more potentially affected by CVE-2023-5072 via org.json:json (20131018)

org.json:json MAVEN version 20131018 is affected by a known vulnerability. The following packages have a transitive dependency on org.json:json and may be impacted: - ai.idylnlp:idylnlp-models-deeplearning =1.0.0, =1.0.0, =1.0.0, =1.2.1, =2.1.2, =0.0.1, =0.0.1, =1.3.0-oss and more Source cves:...

ca.carleton.gcrc:nunaliit2-adhocqueries (>=2.2.5, <=2.2.7), ca.carleton.gcrc:nunaliit2-auth-common (>=2.2.5, <=2.2.7) +304 more potentially affected by CVE-2023-5072 via org.json:json (20151123)

org.json:json MAVEN version 20151123 is affected by a known vulnerability. The following packages have a transitive dependency on org.json:json and may be impacted: - ca.carleton.gcrc:nunaliit2-adhocqueries =2.2.5, =2.2.5, =2.2.5, =2.2.5, =2.2.5, =2.2.5, =2.2.5, =2.2.5, =2.2.5, =2.2.5, =2.2.5,...

ai.grakn:grakn-dist (>=0.7.0, <=0.13.0), ai.grakn:grakn-engine (>=0.6.1, <=0.13.0) +1107 more potentially affected by CVE-2023-5072 via org.json:json (20160212)

org.json:json MAVEN version 20160212 is affected by a known vulnerability. The following packages have a transitive dependency on org.json:json and may be impacted: - ai.grakn:grakn-dist =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.7.0, =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.11....

br.com.totalvoice:totalvoice-java (>=1.0.3, <=1.4.13), cc.openkit:open_kit (>=1.0.2, <=1.1.18) +258 more potentially affected by CVE-2023-5072 via org.json:json (20171018)

org.json:json MAVEN version 20171018 is affected by a known vulnerability. The following packages have a transitive dependency on org.json:json and may be impacted: - br.com.totalvoice:totalvoice-java =1.0.3, =1.0.2, =0.17.1, =2.3.1, =3.0.0.release, =3.0.0.release, =20180110, =1.0.0,...

app.simplifyom.sdk:app.simplifyom.sdk (>=1.0.0, <=1.0.6), app.ztash:ztash-java-sdk-secretsmanager (>=1.0.0, <=1.2.0) +739 more potentially affected by CVE-2023-5072 via org.json:json (20180130)

org.json:json MAVEN version 20180130 is affected by a known vulnerability. The following packages have a transitive dependency on org.json:json and may be impacted: - app.simplifyom.sdk:app.simplifyom.sdk =1.0.0, =1.0.0, =1.1, =0.9.0, =2.0, =1.0, =1.0, =1.0, =1.0, =1.0.0, =1.0, =2.0, =3.1.3 -...

ai.tock:bot-test (20.9.3), ai.tock:bot-test-base (20.9.3) +577 more potentially affected by CVE-2023-5072 via org.json:json (20201115)

org.json:json MAVEN version 20201115 is affected by a known vulnerability. The following packages have a transitive dependency on org.json:json and may be impacted: - ai.tock:bot-test 20.9.3 - ai.tock:bot-test-base 20.9.3 - ai.tock:bot-toolkit 20.9.3 - ai.tock:tock-bot-admin-kotlin-compiler-serve...

ai.tock:bot-test (>=23.3.2, <=23.9.0), ai.tock:bot-test-base (>=23.3.2, <=23.9.0) +1233 more potentially affected by CVE-2023-5072 via org.json:json (20230618)

org.json:json MAVEN version 20230618 is affected by a known vulnerability. The following packages have a transitive dependency on org.json:json and may be impacted: - ai.tock:bot-test =23.3.2, =23.3.2, =23.3.2, =23.3.2, =23.3.2, =23.3.2, =23.3.2, =23.3.2, =23.3.2, =23.3.2, =23.3.2, =23.3.2,...

au.com.clearboxsystems.maven.plugins.nodejs:nodejs-maven-plugin (>=1.1, <=1.2.2), au.com.dius:pact-jvm-provider-spring_2.11 (>=3.4.0, <=3.5.18) +3665 more potentially affected by CVE-2023-5072 via org.json:json (20090211)

org.json:json MAVEN version 20090211 is affected by a known vulnerability. The following packages have a transitive dependency on org.json:json and may be impacted: - au.com.clearboxsystems.maven.plugins.nodejs:nodejs-maven-plugin =1.1, =3.4.0, =3.5.4-rc.0, =1.0, =1.2.0, =2.0.0, =1.0.0, =1.0.0,...