CVE-2023-33546

2023-06-0100:00:00

mitre

github.com

janino 3.1.9

dos vulnerability

expression evaluator

user-supplied input

stack overflow

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.9%

JSON

Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by multiple parties because Janino is not intended for use with untrusted input.