{"id":"CVE-2022-25024","aliases":["EUVD-2023-0101","GHSA-8rj5-2857-877j","PYSEC-2023-149"],"status":"published","title":"json2xml Uncaught Exception vulnerability","description":"The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0131,"percentile":0.70848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248","CWE-754"],"published":"2023-08-22T00:00:00Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"PyPI","package":"json2xml","fixed_in":["3.14.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"json2xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"json2xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0"}]}],"versions":["0.1","0.2","0.3","0.4","0.5","0.6","1.0.0","1.0.1","1.1.0","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","2.0.0","2.1.0","2.1.1","2.2.0","2.2.1","2.3.0","3.0.0","3.0.1","3.10.0","3.10.0rc1","3.12.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.5.0","3.6.0","3.7.0","3.7.0b1","3.7.0b2","3.8.0","3.8.1","3.8.2","3.8.3","3.8.4","3.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"json2xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0"}]}],"versions":["0.1","0.2","0.3","0.4","0.5","0.6","1.0.0","1.0.1","1.1.0","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","2.0.0","2.1.0","2.1.1","2.2.0","2.2.1","2.3.0","3.0.0","3.0.1","3.10.0","3.10.0rc1","3.12.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.5.0","3.6.0","3.7.0","3.7.0b1","3.7.0b2","3.8.0","3.8.1","3.8.2","3.8.3","3.8.4","3.9.0"]}],"products":[{"vendor":"vinitkumar","product":"json2xml"}],"references":[{"url":"https://github.com/vinitkumar/json2xml/issues/106","tags":["x_transferred","Exploit","Issue Tracking","Patch","report","web"]},{"url":"https://github.com/vinitkumar/json2xml/pull/107","tags":["x_transferred","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/vinitkumar/json2xml/pull/107/files","tags":["x_transferred","Patch","web"]},{"url":"https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads/","tags":["x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25024","tags":["advisory"]},{"url":"https://github.com/vinitkumar/json2xml/commit/a9cd75b61329801b47a8fba7473bce6c85a38b9b","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/json2xml/PYSEC-2023-149.yaml","tags":["web"]},{"url":"https://packaging.python.org/en/latest/guides/analyzing-pypi-package-downloads","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8rj5-2857-877j","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25024.json","tags":["advisory"]},{"url":"https://github.com/vinitkumar/json2xml","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-25024","description":"The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2024-10-03T17:46:39.654Z","updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2023-0101","description":"The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2024-10-03T17:46:39Z","updated_at":"2026-11-03T00:27:54.233481Z"}],"ghsa":[{"id":"GHSA-8rj5-2857-877j","title":"json2xml Uncaught Exception vulnerability","description":"The json2xml package for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.","status":"published","published":"2023-08-23T13:19:55Z","modified":"2024-09-27T15:46:27Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248","CWE-754"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2022-25024","description":"The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.","status":"published","published":"2023-08-22T19:16:22.173Z","modified":"2026-06-17T04:32:57.033Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:07:39.811118Z"}],"osv":[{"id":"GHSA-8rj5-2857-877j","title":"json2xml Uncaught Exception vulnerability","description":"The json2xml package for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.","status":"published","published":"2023-08-23T13:19:55Z","modified":"2025-02-18T05:44:32.826857Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248","CWE-754"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"CVE-2022-25024","description":"The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2026-10-28T02:31:08.848706298Z","updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"PYSEC-2023-149","description":"The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.","status":"published","published":"2023-08-22T19:16:00Z","modified":"2026-06-10T17:01:49.390786286Z","updated_at":"2026-11-02T15:52:53.837392Z"}]}}