CVE-2022-3433
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse...
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
- Record
CVE-2022-3433- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-328, CWE-326
- Updated
- 2026-11-02
CVE List No score
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
- Record
CVE-2022-3433- Weakness
- CWE-328
- Updated
- 2026-11-02
EUVDEUVD-2022-42809 No score
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
- Record
EUVD-2022-42809- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p383-f595-x4qw
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse...
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
- Record
GHSA-p383-f595-x4qw- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-326, CWE-328, CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-3433
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
- Record
UBUNTU-CVE-2022-3433- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV No score
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
- Record
CVE-2022-3433- Weakness
- CWE-328
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-3433 No score
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
- Record
DEBIAN-CVE-2022-3433- Updated
- 2026-11-03
OSVHSEC-2023-0001 No score
Hash flooding vulnerability in aeson
Hash flooding vulnerability in aeson
aeson was vulnerable to hash flooding (a.k.a. hash DoS). The issue is a consequence of the HashMap implementation from unordered-containers. It results in a denial of service through CPU consumption. This technique has been used in real-world attacks against a variety of languages, libraries and frameworks over the years.
- Record
HSEC-2023-0001- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
haskell-aesonDebian:12 |
before 2.0.3.0-1 | 2.0.3.0-1 |
haskell-aesonDebian:13 |
before 2.0.3.0-1 | 2.0.3.0-1 |
haskell-aesonDebian:14 |
before 2.0.3.0-1 | 2.0.3.0-1 |
aesonHackage |
0.4.0.0 up to 2.0.1.0, plus listed versions 0.10.0.00.11.0.00.11.1.00.11.1.10.11.1.2 Show 45 moreShow less0.11.1.30.11.1.40.11.2.00.11.2.10.11.3.00.4.0.10.5.0.00.6.0.00.6.0.10.6.0.20.6.1.00.6.2.00.6.2.10.7.0.00.7.0.10.7.0.20.7.0.30.7.0.40.7.0.50.7.0.60.8.0.00.8.0.10.8.0.20.8.1.00.8.1.10.9.0.00.9.0.11.0.0.01.0.1.01.0.2.01.0.2.11.1.0.01.1.1.01.1.2.01.2.0.01.2.1.01.2.2.01.2.3.01.2.4.01.3.0.01.3.1.01.3.1.11.4.0.01.4.1.01.4.2.0 |
2.0.1.0 |
haskell-aesonUbuntu:16.04:LTS |
All versions, plus listed versions 0.8.0.2-30.8.0.2-50.10.0.0-3 |
None known |
haskell-aesonUbuntu:18.04:LTS |
All versions, plus listed versions 1.0.2.1-6build11.1.2.0-1build1 |
None known |
haskell-aesonUbuntu:20.04:LTS |
All versions, plus listed versions 1.4.2.0-5 |
None known |
haskell-aesonUbuntu:22.04:LTS |
All versions, plus listed versions 1.4.7.1-2build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3433 is a medium vulnerability (CVSS 6.5) in Haskell Aeson, published October 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in haskell-aeson 2.0.3.0-1.
References
cs-syd.eu/posts/2021-09-11-json-vulnerability
nvd.nist.gov/vuln/detail/CVE-2022-3433
github.com/advisories/GHSA-p383-f595-x4qw
security-tracker.debian.org/tracker/CVE-2022-3433
frasertweedale.github.io/blog-fp/posts/2021-10-12-aeson-hash-flooding-protection.html
Left out here: 16 versions. The JSON record has them.