What’s Vulnerable › Vulnerabilities

CVE-2023-1370: Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-22 · updated 2026-06-17
• Weakness: CWE-674

Description

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

Affected products

• json-smart: before 2.4.9 — fixed in 2.4.9

How to fix

Upgrade to a fixed version: json-smart 2.4.9. Check the vendor advisory for mitigations.

References

• https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/
• https://security.netapp.com/advisory/ntap-20240621-0006/
• https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/
• https://security.netapp.com/advisory/ntap-20240621-0006/

Get alerted when CVE-2023-1370 or the next vulnerability affects your stack