Every CVE Search/ Get API key

CVE-2023-4043

Parsson DoS when parsing numbers from untrusted sources

5.9 MediumFix available

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.

To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.89%Up 0.8 points since Nov 3, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.9

Parsson DoS when parsing numbers from untrusted sources

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.

To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Record
CVE-2023-4043
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-834
Updated
2026-11-02
EUVDEUVD-2023-2963 5.9

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.

To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Record
EUVD-2023-2963
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-g8p6-p27c-52fx 5.9

Eclipse Parsson Denial of Service vulnerability

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.

To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Record
GHSA-g8p6-p27c-52fx
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-834
Updated
2026-11-02
NVD 5.9

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.

To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Record
CVE-2023-4043
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-834
Updated
2026-11-02
OSV 5.9

Parsson DoS when parsing numbers from untrusted sources

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.

To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Record
CVE-2023-4043
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-834
Updated
2026-11-02
OSVGHSA-g8p6-p27c-52fx 5.9

Eclipse Parsson Denial of Service vulnerability

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.

To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Record
GHSA-g8p6-p27c-52fx
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20, CWE-834
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2024:1192 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.1 security update

Record
RHSA-2024:1192
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1193 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.1 security update

Record
RHSA-2024:1193
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1770768565 No score

TuxCare security update for org.eclipse.parsson (2 CVEs)

TuxCare rebuilt 2 org.eclipse.parsson packages to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.

Record
CLSA-2026-1770768565
Updated
2026-11-02
OSVCLSA-2026-1781657690 No score

TuxCare security update for org.eclipse.parsson (2 CVEs)

TuxCare rebuilt 2 org.eclipse.parsson packages to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.

Record
CLSA-2026-1781657690
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.eclipse.parsson:project
Maven
 1.1.0 up to 1.1.4
1.1.4
org.eclipse.parsson:project
Maven
 before 1.0.5
1.0.5
org.eclipse.parsson:parsson
TuxCare:Maven
From an advisory covering 2 CVEs
 1.0.0 up to 1.0.0-tuxcare.1
1.0.0-tuxcare.1
org.eclipse.parsson:project
TuxCare:Maven
From an advisory covering 2 CVEs
 1.0.0 up to 1.0.0-tuxcare.1
1.0.0-tuxcare.1
org.eclipse.parsson:parsson
TuxCare:Maven
From an advisory covering 2 CVEs
 1.1.1 up to 1.1.1-tuxcare.1
1.1.1-tuxcare.1
org.eclipse.parsson:project
TuxCare:Maven
From an advisory covering 2 CVEs
 1.1.1 up to 1.1.1-tuxcare.1
1.1.1-tuxcare.1
org.eclipse.parsson:project
Maven
 1.1.0 up to 1.1.4, plus listed versions
1.1.11.1.21.1.3
1.1.4
org.eclipse.parsson:project
Maven
 before 1.0.5, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
1.0.5
eap8-apache-sshd
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:2.12.0-1.redhat_00001.1.el8eap
0:2.12.0-1.redhat_00001.1.el8eap
eap8-eclipse-jgit
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:6.6.1.202309021850-1.r_redhat_00001.1.el8eap
0:6.6.1.202309021850-1.r_redhat_00001.1.el8eap
Show 28 moreShow less
Affected packages
PackageAffectedFixed
eap8-log4j
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:2.19.0-2.redhat_00001.1.el8eap
0:2.19.0-2.redhat_00001.1.el8eap
eap8-lucene-analyzers-common
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el8eap
0:8.11.2-2.redhat_00001.1.el8eap
eap8-lucene-core
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el8eap
0:8.11.2-2.redhat_00001.1.el8eap
eap8-lucene-facet
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el8eap
0:8.11.2-2.redhat_00001.1.el8eap
eap8-lucene-join
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el8eap
0:8.11.2-2.redhat_00001.1.el8eap
eap8-lucene-queries
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el8eap
0:8.11.2-2.redhat_00001.1.el8eap
eap8-lucene-queryparser
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el8eap
0:8.11.2-2.redhat_00001.1.el8eap
eap8-lucene-solr
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el8eap
0:8.11.2-2.redhat_00001.1.el8eap
eap8-parsson
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:1.1.5-1.redhat_00001.1.el8eap
0:1.1.5-1.redhat_00001.1.el8eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.0.1-3.GA_redhat_00002.1.el8eap
0:8.0.1-3.GA_redhat_00002.1.el8eap
eap8-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.0.1-3.GA_redhat_00002.1.el8eap
0:8.0.1-3.GA_redhat_00002.1.el8eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.0.1-3.GA_redhat_00002.1.el8eap
0:8.0.1-3.GA_redhat_00002.1.el8eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 4 CVEs
 before 0:8.0.1-3.GA_redhat_00002.1.el8eap
0:8.0.1-3.GA_redhat_00002.1.el8eap
eap8-apache-sshd
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:2.12.0-1.redhat_00001.1.el9eap
0:2.12.0-1.redhat_00001.1.el9eap
eap8-eclipse-jgit
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:6.6.1.202309021850-1.r_redhat_00001.1.el9eap
0:6.6.1.202309021850-1.r_redhat_00001.1.el9eap
eap8-log4j
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:2.19.0-2.redhat_00001.1.el9eap
0:2.19.0-2.redhat_00001.1.el9eap
eap8-lucene-analyzers-common
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el9eap
0:8.11.2-2.redhat_00001.1.el9eap
eap8-lucene-core
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el9eap
0:8.11.2-2.redhat_00001.1.el9eap
eap8-lucene-facet
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el9eap
0:8.11.2-2.redhat_00001.1.el9eap
eap8-lucene-join
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el9eap
0:8.11.2-2.redhat_00001.1.el9eap
eap8-lucene-queries
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el9eap
0:8.11.2-2.redhat_00001.1.el9eap
eap8-lucene-queryparser
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el9eap
0:8.11.2-2.redhat_00001.1.el9eap
eap8-lucene-solr
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.11.2-2.redhat_00001.1.el9eap
0:8.11.2-2.redhat_00001.1.el9eap
eap8-parsson
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:1.1.5-1.redhat_00001.1.el9eap
0:1.1.5-1.redhat_00001.1.el9eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.0.1-3.GA_redhat_00002.1.el9eap
0:8.0.1-3.GA_redhat_00002.1.el9eap
eap8-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.0.1-3.GA_redhat_00002.1.el9eap
0:8.0.1-3.GA_redhat_00002.1.el9eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.0.1-3.GA_redhat_00002.1.el9eap
0:8.0.1-3.GA_redhat_00002.1.el9eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 4 CVEs
 before 0:8.0.1-3.GA_redhat_00002.1.el9eap
0:8.0.1-3.GA_redhat_00002.1.el9eap

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4043 is a medium vulnerability (CVSS 5.9) in Eclipse Parsson, published November 3, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in org.eclipse.parsson:project 1.1.4.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open