Loading vulnerability…
Uncontrolled recursion in Jettison JSONArray
CVE-2023-1436 is an uncontrolled-recursion vulnerability in the Jettison JSON library. Constructing a JSONArray from a Collection containing a self-reference in one of its elements triggers infinite recursion and throws a StackOverflowError. The flaw can disrupt applications using the affected construction path, resulting in denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation causes stack exhaustion and a StackOverflowError during JSONArray construction, potentially disrupting the affected application and causing denial of service. The extent of disruption depends on how the application handles the error.
If you can’t patch tonight, do this now.
Until updates can be deployed, prevent untrusted or externally controlled object graphs from being passed to JSONArray constructors, and validate that Collections are acyclic before JSON serialization. Implement input and resource controls to limit the availability impact of serialization failures.
Patch, then assume compromise.
Upgrade Jettison and related packages to version 1.5.4 or later, or install the applicable vendor-fixed release for products bundling Jettison. Fixed Red Hat releases include JBoss EAP 7.4.12, Single Sign-On 7.6.5, and Red Hat build of Quarkus 2.13.8. Back up JBoss EAP installations and deployed applications before updating, and apply previously released relevant errata where required by the product update instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.