CVE-2013-6401
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions...
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
Exploit likelihood
What each source reports
NVD Score used
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
- Record
CVE-2013-6401- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
- Record
CVE-2013-6401- Updated
- 2026-11-02
EUVDEUVD-2013-6222 No score
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
- Record
EUVD-2013-6222- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qjq9-rwgx-jjhc No score
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions...
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
- Record
GHSA-qjq9-rwgx-jjhc- Updated
- 2026-11-02
OSV No score
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
- Record
CVE-2013-6401- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6401 No score
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
- Record
DEBIAN-CVE-2013-6401- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10331-1 No score
libjansson-devel-2.7-1.9 on GA media
These are all security issues fixed in the libjansson-devel-2.7-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10331-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6401 No score
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
- Record
UBUNTU-CVE-2013-6401- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6401 is a medium vulnerability (CVSS 5.0) in Jansson Project Jansson, published March 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.01%, the 80th percentile. Fixed in jansson 2.6-1.
References
bugzilla.redhat.com/show_bug.cgi?id=1035538
lists.opensuse.org/opensuse-updates/2014-03/msg00057.html
github.com/akheron/jansson/commit/8f80c2d83808150724d31793e6ade92749b1faa4
comments.gmane.org/gmane.comp.security.oss.general/12099
nvd.nist.gov/vuln/detail/CVE-2013-6401