Java Json Tools
Monthly
Unbounded resource allocation in jackson-coreutils 2.0 exposes any Java application using the library's JSON Pointer parser to remote denial of service. The `TreePointer.tokensFromInput` method in the JSON Pointer parsing component fails to enforce limits on resource allocation when processing attacker-controlled input, allowing a remote unauthenticated attacker to trigger excessive memory or CPU consumption. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure, and no patch is available at time of analysis.
Improper access controls in java-json-tools json-patch (versions up to 1.13) allow low-privileged, network-accessible attackers to abuse the CopyOperation.apply and MoveOperation.apply methods to reference JSON document paths outside their permitted scope, enabling unauthorized data reads or writes within the processed JSON structure. The flaw resides in src/main/java/com/github/fge/jsonpatch/CopyOperation.java and affects any application that exposes JSON Patch processing to partially-trusted callers without additional server-side path validation. A public proof-of-concept exists via GitHub issue #170; no CISA KEV listing has been recorded, and the CVSS 4.0 score of 5.3 reflects the limited C/I impact and mandatory low-privilege prerequisite.
Uncontrolled resource consumption in java-json-tools jackson-coreutils 2.0 allows remote unauthenticated attackers to trigger a denial-of-service condition by submitting crafted input that causes BigDecimal.toPlainString() in JacksonUtils.java to exhaust CPU or memory resources. The root cause is CWE-400 (Uncontrolled Resource Consumption), a well-understood class of vulnerability in Java BigDecimal handling where specially constructed numeric values - such as those with extremely large scale or unscaled value - produce pathologically long string representations. No public exploit has been incorporated into the CISA KEV catalog, though exploit code was publicly disclosed via a GitHub issue report. The maintainer has not responded to responsible disclosure.
Server-side request forgery in jackson-coreutils 2.0 allows remote unauthenticated attackers to manipulate the server into issuing arbitrary outbound HTTP requests by supplying a crafted URL to the JsonLoader.fromURL function. The vulnerability originates from insufficient URL validation in the library's JSON loading component, enabling internal network probing, access to cloud metadata endpoints, or interaction with internal services not otherwise reachable. A public proof-of-concept exists via the project's GitHub issue tracker, and the maintainer has not responded to the disclosure; no patch is available at time of analysis.
Uncontrolled resource consumption in java-json-tools json-patch up to version 1.13 allows remote unauthenticated attackers to trigger service degradation by sending crafted JSON Patch documents to the JsonPatch.apply() handler. The vulnerability resides in the Patch Operation Handler component and carries no confidentiality or integrity impact - purely availability. A public proof-of-concept has been disclosed via a GitHub issue report, though no KEV listing indicates active exploitation at this time.
Stack exhaustion in java-json-tools json-patch ≤1.13 enables remote unauthenticated denial of service by submitting a crafted deeply-nested JSON Merge Patch document to any application endpoint that invokes JsonMergePatch.fromJson. The vulnerability triggers an uncontrolled recursive deserialization path in JsonMergePatchDeserializer.java, causing JVM thread stack exhaustion. The CVSS 4.0 vector (VC:N/VI:N/VA:L) confirms the impact is limited to availability; no confidentiality or integrity impact has been identified. A public exploit/proof-of-concept exists in the GitHub issue tracker, and no patched release version has been independently confirmed.
Unbounded resource allocation in jackson-coreutils 2.0 exposes any Java application using the library's JSON Pointer parser to remote denial of service. The `TreePointer.tokensFromInput` method in the JSON Pointer parsing component fails to enforce limits on resource allocation when processing attacker-controlled input, allowing a remote unauthenticated attacker to trigger excessive memory or CPU consumption. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure, and no patch is available at time of analysis.
Improper access controls in java-json-tools json-patch (versions up to 1.13) allow low-privileged, network-accessible attackers to abuse the CopyOperation.apply and MoveOperation.apply methods to reference JSON document paths outside their permitted scope, enabling unauthorized data reads or writes within the processed JSON structure. The flaw resides in src/main/java/com/github/fge/jsonpatch/CopyOperation.java and affects any application that exposes JSON Patch processing to partially-trusted callers without additional server-side path validation. A public proof-of-concept exists via GitHub issue #170; no CISA KEV listing has been recorded, and the CVSS 4.0 score of 5.3 reflects the limited C/I impact and mandatory low-privilege prerequisite.
Uncontrolled resource consumption in java-json-tools jackson-coreutils 2.0 allows remote unauthenticated attackers to trigger a denial-of-service condition by submitting crafted input that causes BigDecimal.toPlainString() in JacksonUtils.java to exhaust CPU or memory resources. The root cause is CWE-400 (Uncontrolled Resource Consumption), a well-understood class of vulnerability in Java BigDecimal handling where specially constructed numeric values - such as those with extremely large scale or unscaled value - produce pathologically long string representations. No public exploit has been incorporated into the CISA KEV catalog, though exploit code was publicly disclosed via a GitHub issue report. The maintainer has not responded to responsible disclosure.
Server-side request forgery in jackson-coreutils 2.0 allows remote unauthenticated attackers to manipulate the server into issuing arbitrary outbound HTTP requests by supplying a crafted URL to the JsonLoader.fromURL function. The vulnerability originates from insufficient URL validation in the library's JSON loading component, enabling internal network probing, access to cloud metadata endpoints, or interaction with internal services not otherwise reachable. A public proof-of-concept exists via the project's GitHub issue tracker, and the maintainer has not responded to the disclosure; no patch is available at time of analysis.
Uncontrolled resource consumption in java-json-tools json-patch up to version 1.13 allows remote unauthenticated attackers to trigger service degradation by sending crafted JSON Patch documents to the JsonPatch.apply() handler. The vulnerability resides in the Patch Operation Handler component and carries no confidentiality or integrity impact - purely availability. A public proof-of-concept has been disclosed via a GitHub issue report, though no KEV listing indicates active exploitation at this time.
Stack exhaustion in java-json-tools json-patch ≤1.13 enables remote unauthenticated denial of service by submitting a crafted deeply-nested JSON Merge Patch document to any application endpoint that invokes JsonMergePatch.fromJson. The vulnerability triggers an uncontrolled recursive deserialization path in JsonMergePatchDeserializer.java, causing JVM thread stack exhaustion. The CVSS 4.0 vector (VC:N/VI:N/VA:L) confirms the impact is limited to availability; no confidentiality or integrity impact has been identified. A public exploit/proof-of-concept exists in the GitHub issue tracker, and no patched release version has been independently confirmed.