Every CVE Search/ Get API key

CVE-2022-45688

json stack overflow vulnerability

7.5 HighPublic exploitFix available

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.26%Up 0.4 points since Dec 14, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Record
CVE-2022-45688
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
CVE List 7.5

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Record
CVE-2022-45688
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2022-7491 7.5

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Record
EUVD-2022-7491
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-3vqj-43w4-2q58 7.5

json stack overflow vulnerability

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 and org.json:json before version 20230227 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Record
GHSA-3vqj-43w4-2q58
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 7.5

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Record
CVE-2022-45688
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-3vqj-43w4-2q58 7.5

json stack overflow vulnerability

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 and org.json:json before version 20230227 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Record
GHSA-3vqj-43w4-2q58
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
Show 5 moreShow less
OSVRHLW-2026-1da18ff8e343fdf8 7.5

Lightwell Security Advisory: json 20220320.0.0.rhlw-00003

Red Hat Lightwell has released org.json:json 20220320.0.0.rhlw-00003 with a backported security fix.

CVE-2022-45688: A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

This patched artifact is a drop-in replacement for org.json:json 20220320.0.0 from Maven Central.

Record
RHLW-2026-1da18ff8e343fdf8
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2025-1760313982 No score

TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.1.

Record
CLSA-2025-1760313982
Updated
2026-11-02
OSVCLSA-2025-1760313984 No score

TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20090211-tuxcare.1.

Record
CLSA-2025-1760313984
Updated
2026-11-02
OSVopenSUSE-SU-2024:14371-1 No score

json-java-20240303-1.1 on GA media

These are all security issues fixed in the json-java-20240303-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14371-1
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2022-45688 No score

CVE-2022-45688 in org.json:json - Patched by Root

Root has patched CVE-2022-45688 in the org.json:json package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2022-45688
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.json:json
Maven
 before 20230227
20230227
cn.hutool:hutool-json
Maven
 before 5.8.25
5.8.25
org.json:json
TuxCare:Maven
 20140107 up to 20140107-tuxcare.1
20140107-tuxcare.1
org.json:json
TuxCare:Maven
 20090211 up to 20090211-tuxcare.1
20090211-tuxcare.1
cn.hutool:hutool-json
Maven
 before 5.8.25, plus listed versions
4.0.04.0.14.0.104.0.114.0.12
Show 45 moreShow less
4.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.1.04.1.14.1.104.1.114.1.124.1.134.1.144.1.154.1.164.1.174.1.184.1.194.1.24.1.204.1.214.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.14.3.04.3.14.3.24.4.04.4.14.4.24.4.34.4.44.4.54.5.04.5.14.5.104.5.114.5.12
5.8.25
org.json:json
Maven
 before 20230227, plus listed versions
2007082920080701200902112013101820140107
Show 17 moreShow less
2014111320150729201511232016021220160807201608102017051620171018201801302018081320190722202005182020111520210307202112052022032020220924
20230227
org.json:json
Red Hat Lightwell:Maven
 before 20220320.0.0.rhlw-00003, plus listed versions
2007082920080701200902112013101820140107
Show 17 moreShow less
2014111320150729201511232016021220160807201608102017051620171018201801302018081320190722202005182020111520210307202112052022032020220320.0.0
20220320.0.0.rhlw-00003
org.json:json
Root:Maven
 before 20220320-aikido.1
20220320-aikido.120220320-aikido.2
io.root.org.json:json
Root:Maven
 before 20220320-root.io.1
20220320-root.io.120220320-root.io.220230227-root.io.120230227-root.io.220230227-root.io.3
json-java
openSUSE:Tumbleweed
 before 20240303-1.1
20240303-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubscabench/jsonorg-fn12024-01-21
PoC in GitHubscabench/jsonorg-fp12023-12-28
PoC in GitHubscabench/jsonorg-fp22023-12-29
PoC in GitHubscabench/jsonorg-fp32023-12-29
PoC in GitHubscabench/jsonorg-tp12023-12-27

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45688 is a high vulnerability (CVSS 7.5) in Hutool, published December 13, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in org.json:json 20230227.

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 141 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open