CVE-2023-51074

json-path Out-of-bounds Write vulnerability

5.3 MediumFix available

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.68%Up 0.6 points since Dec 28, 2023

What each source reports

NVD Score used 5.3

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Record: CVE-2023-51074
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

CVE List No score

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Record: CVE-2023-51074
Updated: 2026-11-02

EUVDEUVD-2023-3260 No score

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Record: EUVD-2023-3260
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pfh2-hfmq-phg5 5.3

json-path Out-of-bounds Write vulnerability

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Record: GHSA-pfh2-hfmq-phg5
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-787
Updated: 2026-11-02

OSVGHSA-pfh2-hfmq-phg5 5.3

json-path Out-of-bounds Write vulnerability

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Record: GHSA-pfh2-hfmq-phg5
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-787
Updated: 2026-11-02

OSVOESA-2024-1252 5.3

json-path security update

Java DSL for reading and testing JSON documents.

Security Fix(es):

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.(CVE-2023-51074)

Record: OESA-2024-1252
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

Show 12 moreShow less

OSVRHLW-2026-a4c4a4bf58e29184 5.3

Lightwell Security Advisory: json-path 2.7.0.rhlw-00001

Red Hat Lightwell has released com.jayway.jsonpath:json-path 2.7.0.rhlw-00001 with a backported security fix.

CVE-2023-51074: json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

This patched artifact is a drop-in replacement for com.jayway.jsonpath:json-path 2.7.0 from Maven Central.

Record: RHLW-2026-a4c4a4bf58e29184
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHLW-2026-f8f17f4598510b8d 5.3

Lightwell Security Advisory: json-path 2.8.0.rhlw-00001

Red Hat Lightwell has released com.jayway.jsonpath:json-path 2.8.0.rhlw-00001 with a backported security fix.

CVE-2023-51074: json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

This patched artifact is a drop-in replacement for com.jayway.jsonpath:json-path 2.8.0 from Maven Central.

Record: RHLW-2026-f8f17f4598510b8d
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-51074 5.3

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Record: UBUNTU-CVE-2023-51074
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVCLSA-2026-1788766643 No score

TuxCare security update for com.jayway.jsonpath:json-path (1 CVE)

TuxCare rebuilt com.jayway.jsonpath:json-path to address 1 CVE. Fixed in 2.2.0-tuxcare.1.

Record: CLSA-2026-1788766643
Updated: 2026-11-02

OSVCLSA-2026-1788767433 No score

TuxCare security update for com.jayway.jsonpath:json-path (1 CVE)

TuxCare rebuilt com.jayway.jsonpath:json-path to address 1 CVE. Fixed in 2.6.0-tuxcare.1.

Record: CLSA-2026-1788767433
Updated: 2026-11-02

OSVCLSA-2026-1788853239 No score

TuxCare security update for com.jayway.jsonpath:json-path (1 CVE)

TuxCare rebuilt com.jayway.jsonpath:json-path to address 1 CVE. Fixed in 2.8.0-tuxcare.1.

Record: CLSA-2026-1788853239
Updated: 2026-11-02

OSVCLSA-2026-1788853251 No score

TuxCare security update for com.jayway.jsonpath:json-path (1 CVE)

TuxCare rebuilt com.jayway.jsonpath:json-path to address 1 CVE. Fixed in 2.5.0-tuxcare.1.

Record: CLSA-2026-1788853251
Updated: 2026-11-02

OSVCLSA-2026-1788853304 No score

TuxCare security update for com.jayway.jsonpath:json-path (1 CVE)

TuxCare rebuilt com.jayway.jsonpath:json-path to address 1 CVE. Fixed in 2.7.0-tuxcare.1.

Record: CLSA-2026-1788853304
Updated: 2026-11-02

OSVCLSA-2026-1789366696 No score

TuxCare security update for org.apache.commons:commons-configuration2 (2 CVEs)

TuxCare rebuilt org.apache.commons:commons-configuration2 to address 2 CVEs. Fixed in 2.8.0-tuxcare.1.

Record: CLSA-2026-1789366696
Updated: 2026-11-02

OSVCLSA-2026-1789382508 No score

TuxCare security update for com.jayway.jsonpath:json-path (1 CVE)

TuxCare rebuilt com.jayway.jsonpath:json-path to address 1 CVE. Fixed in 2.4.0-tuxcare.1.

Record: CLSA-2026-1789382508
Updated: 2026-11-02

OSV No score

json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

Record: CVE-2023-51074
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2023-51074 No score

CVE-2023-51074 in io.root.com.jayway.jsonpath:json-path - Patched by Root

Root has patched CVE-2023-51074 in the io.root.com.jayway.jsonpath:json-path package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2023-51074
Updated: 2026-11-02

Affected products

json-path jayway jsonpath

Affected packages

Affected packages
Package	Affected	Fixed
`com.jayway.jsonpath:json-path` Maven	2.2.0 up to 2.9.0	2.9.0
`com.jayway.jsonpath:json-path` TuxCare:Maven	2.2.0 up to 2.2.0-tuxcare.1	2.2.0-tuxcare.1
`com.jayway.jsonpath:json-path` TuxCare:Maven	2.6.0 up to 2.6.0-tuxcare.1	2.6.0-tuxcare.1
`com.jayway.jsonpath:json-path` TuxCare:Maven	2.8.0 up to 2.8.0-tuxcare.1	2.8.0-tuxcare.1
`com.jayway.jsonpath:json-path` TuxCare:Maven	2.5.0 up to 2.5.0-tuxcare.1	2.5.0-tuxcare.1
`com.jayway.jsonpath:json-path` TuxCare:Maven	2.7.0 up to 2.7.0-tuxcare.1	2.7.0-tuxcare.1
`com.jayway.jsonpath:json-path` TuxCare:Maven	2.4.0 up to 2.4.0-tuxcare.1	2.4.0-tuxcare.1
`com.jayway.jsonpath:json-path` Maven	2.2.0 up to 2.9.0, plus listed versions 2.3.02.4.02.5.02.6.02.7.02.8.0	2.9.0
`json-path` openEuler:20.03-LTS-SP1	before 2.1.0-2.oe1	2.1.0-2.oe1
`json-path` openEuler:20.03-LTS-SP4	before 2.1.0-2.oe2003sp4	2.1.0-2.oe2003sp4

Show 15 moreShow less

Affected packages
Package	Affected	Fixed
`json-path` openEuler:22.03-LTS	before 2.1.0-2.oe2203sp3	2.1.0-2.oe2203sp3
`json-path` openEuler:22.03-LTS-SP1	before 2.1.0-2.oe2203sp1	2.1.0-2.oe2203sp1
`json-path` openEuler:22.03-LTS-SP2	before 2.1.0-2.oe2203sp2	2.1.0-2.oe2203sp2
`json-path` openEuler:22.03-LTS-SP3	before 2.1.0-2.oe2203sp3	2.1.0-2.oe2203sp3
`com.jayway.jsonpath:json-path` Red Hat Lightwell:Maven	before 2.7.0.rhlw-00001, plus listed versions 0.5.10.5.20.5.30.5.40.5.5 Show 16 moreShow less 0.5.60.8.00.8.10.9.00.9.11.0.01.1.01.2.02.0.02.1.02.2.02.3.02.4.02.5.02.6.02.7.0	2.7.0.rhlw-00001
`com.jayway.jsonpath:json-path` Red Hat Lightwell:Maven	2.8.0 up to 2.8.0.rhlw-00001	2.8.0.rhlw-00001
`io.root.com.jayway.jsonpath:json-path` Root:Maven	before 2.8.0-root.io.1	2.8.0-root.io.1
`com.jayway.jsonpath:json-path` Root:Maven	before 2.8.0-aikido.1	2.8.0-aikido.1
`jayway-jsonpath` Ubuntu:18.04:LTS	All versions, plus listed versions 2.0.0-3	None known
`jayway-jsonpath` Ubuntu:20.04:LTS	All versions, plus listed versions 2.0.0-5	None known
`jayway-jsonpath` Ubuntu:22.04:LTS	All versions, plus listed versions 2.0.0-5	None known
`jayway-jsonpath` Ubuntu:24.04:LTS	All versions, plus listed versions 2.0.0-5	None known
`jayway-jsonpath` Ubuntu:25.10	All versions, plus listed versions 2.0.0-5	None known
`jayway-jsonpath` Ubuntu:26.10	All versions, plus listed versions 2.0.0-5build1	None known
`jayway-jsonpath` Ubuntu:26.04:LTS	All versions, plus listed versions 2.0.0-52.0.0-5build1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-51074 is a medium vulnerability (CVSS 5.3) in Json-path Jayway Jsonpath, published December 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in com.jayway.jsonpath:json-path 2.9.0.

References

Show 4 moreShow less