CVE-2023-42278
hutool Buffer Overflow vulnerability
CVE-2023-42278 is a high vulnerability (CVSS 7.5) in Hutool, published September 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in cn.hutool:hutool-core 5.8.22.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 0.84%EPSS, 58th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.8.22cn.hutool:hutool-core +3 more
Description
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cn.hutool:hutool-coreMaven | before 5.8.22 | 5.8.22 |
cn.hutool:hutool-jsonMaven | before 5.8.22 | 5.8.22 |
cn.hutool:hutool-coreMaven | before 5.8.22, plus listed versions 4.0.04.0.14.0.104.0.114.0.12 Show 45 moreShow less4.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.1.04.1.14.1.104.1.114.1.124.1.134.1.144.1.154.1.164.1.174.1.184.1.194.1.24.1.204.1.214.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.14.3.04.3.14.3.24.4.04.4.14.4.24.4.34.4.44.4.54.5.04.5.14.5.104.5.114.5.12 | 5.8.22 |
cn.hutool:hutool-jsonMaven | before 5.8.22, plus listed versions 4.0.04.0.14.0.104.0.114.0.12 Show 45 moreShow less4.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.1.04.1.14.1.104.1.114.1.124.1.134.1.144.1.154.1.164.1.174.1.184.1.194.1.24.1.204.1.214.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.14.3.04.3.14.3.24.4.04.4.14.4.24.4.34.4.44.4.54.5.04.5.14.5.104.5.114.5.12 | 5.8.22 |
What each source reports
NVD Score used
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
- Record
CVE-2023-42278- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE ListNo score
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
- Record
CVE-2023-42278- Updated
- 2026-11-02
EUVDEUVD-2023-2589No score
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
- Record
EUVD-2023-2589- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rr66-qh5m-w6mx
hutool Buffer Overflow vulnerability
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
- Record
GHSA-rr66-qh5m-w6mx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVGHSA-rr66-qh5m-w6mx
hutool Buffer Overflow vulnerability
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
- Record
GHSA-rr66-qh5m-w6mx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVNo score
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
- Record
CVE-2023-42278- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 276 versions. The JSON record has them.