CVE-2023-1436: Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-22 · updated 2026-06-17
Weakness: CWE-674

Description

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

Affected products

Jettison: before 1.5.4 — fixed in 1.5.4

How to fix

Upgrade to a fixed version: Jettison 1.5.4. Check the vendor advisory for mitigations.

References

https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/
https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/

Get alerted when CVE-2023-1436 or the next vulnerability affects your stack