CVE-2023-1436: Jettison vulnerable to infinite recursion

March 22, 2023

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

References

github.com/advisories/GHSA-q6g2-g7f3-rr83
github.com/jettison-json/jettison/issues/60
github.com/jettison-json/jettison/pull/62
github.com/jettison-json/jettison/releases/tag/jettison-1.5.4
nvd.nist.gov/vuln/detail/CVE-2023-1436
research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/

Code Behaviors & Features

Detect and mitigate CVE-2023-1436 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →