CVE-2022-39259: Jadx-gui subject to Denial of Service via Swing HTML rendering

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-21 · updated 2026-06-17
Weakness: CWE-20

Description

jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. versions prior to 1.4.5 are subject to a Denial of Service when opening zip files with HTML sequences. This issue has been patched in version 1.4.5. There are no known workarounds.

Affected products

skylot jadx: before 1.4.5 — fixed in 1.4.5

How to fix

Upgrade to a fixed version: skylot jadx 1.4.5. Check the vendor advisory for mitigations.

References

https://github.com/skylot/jadx/security/advisories/GHSA-3r7j-8mqh-6qhx
https://github.com/skylot/jadx/security/advisories/GHSA-3r7j-8mqh-6qhx

Get alerted when CVE-2022-39259 or the next vulnerability affects your stack