{"id":"CVE-2023-4043","aliases":["CLSA-2026-1770768565","CLSA-2026-1781657690","EUVD-2023-2963","GHSA-g8p6-p27c-52fx","RHSA-2024:1192","RHSA-2024:1193"],"status":"published","title":"Parsson DoS when parsing numbers from untrusted sources","description":"In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.\n\n\nTo mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0089,"percentile":0.59618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-834"],"published":"2023-11-03T08:11:39Z","modified":"2026-11-02T19:45:34Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.parsson:project","fixed_in":["1.1.4","1.0.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.parsson:project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.parsson:project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.parsson:parsson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.0-tuxcare.1"}]}],"versions":["1.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.parsson:project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.0-tuxcare.1"}]}],"versions":["1.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.parsson:parsson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1-tuxcare.1"}]}],"versions":["1.1.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.parsson:project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.1"},{"fixed":"1.1.1-tuxcare.1"}]}],"versions":["1.1.1"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.parsson:project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.4"}]}],"versions":["1.1.0","1.1.1","1.1.2","1.1.3"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.parsson:project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.0-1.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-eclipse-jgit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1.202309021850-1.r_redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.19.0-2.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-lucene-analyzers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-lucene-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-lucene-facet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-lucene-join","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-lucene-queries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-lucene-queryparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-lucene-solr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-parsson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.5-1.redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.GA_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.GA_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.GA_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el8","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.GA_redhat_00002.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-apache-sshd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.0-1.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-eclipse-jgit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.1.202309021850-1.r_redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.19.0-2.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-lucene-analyzers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-lucene-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-lucene-facet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-lucene-join","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-lucene-queries","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-lucene-queryparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-lucene-solr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.11.2-2.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-parsson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.5-1.redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.GA_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.GA_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.GA_redhat_00002.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.0::el9","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.1-3.GA_redhat_00002.1.el9eap"}]}],"bundled":4}],"products":[{"vendor":"eclipse","product":"parsson"},{"vendor":"eclipse foundation","product":"parsson"}],"references":[{"url":"https://github.com/eclipse-ee4j/parsson/pull/100","tags":["x_transferred","Patch","fix","web"]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/13","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4043","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g8p6-p27c-52fx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4043.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1192","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254594","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-26209","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1192.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4043","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4043","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4759","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4759","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-35887","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-35887","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35887","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-48795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-48795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","tags":["advisory"]},{"url":"https://access.redhat.com/solutions/7071748","tags":["article"]},{"url":"https://terrapin-attack.com/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1193","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-26210","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1193.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4043","title":"Parsson DoS when parsing numbers from untrusted sources","description":"In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.\n\n\nTo mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.\n\n\n","status":"published","published":"2023-11-03T08:11:39.563Z","modified":"2024-09-05T14:31:17.127Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-20","CWE-834"],"updated_at":"2026-11-02T14:35:30.116696Z"}],"euvd":[{"id":"EUVD-2023-2963","description":"In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.\n\n\nTo mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.\n\n\n","status":"published","published":"2023-11-03T08:11:39Z","modified":"2024-09-05T14:31:17Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:56:03.195853Z"}],"ghsa":[{"id":"GHSA-g8p6-p27c-52fx","title":"Eclipse Parsson Denial of Service vulnerability","description":"In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.\n\n\nTo mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.\n\n\n","status":"published","published":"2023-11-03T09:32:49Z","modified":"2023-11-14T21:48:18Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20","CWE-834"],"updated_at":"2026-11-02T14:37:22.040291Z"}],"nvd":[{"id":"CVE-2023-4043","description":"In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.\n\n\nTo mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.\n\n\n","status":"published","published":"2023-11-03T09:15:13.6Z","modified":"2026-06-17T06:36:58.63Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-834"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"CVE-2023-4043","title":"Parsson DoS when parsing numbers from untrusted sources","description":"In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.\n\n\nTo mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.\n\n\n","status":"published","published":"2023-11-03T08:11:39.563Z","modified":"2026-10-28T02:30:33.399545562Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20","CWE-834"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"GHSA-g8p6-p27c-52fx","title":"Eclipse Parsson Denial of Service vulnerability","description":"In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.\n\n\nTo mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.\n\n\n","status":"published","published":"2023-11-03T09:32:49Z","modified":"2024-02-16T08:17:00.305225Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20","CWE-834"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"RHSA-2024:1192","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.1 security update","status":"published","published":"2024-10-01T23:38:04Z","modified":"2026-10-20T10:02:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1193","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.1 security update","status":"published","published":"2024-10-01T23:38:33Z","modified":"2026-10-20T10:02:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"CLSA-2026-1770768565","title":"TuxCare security update for org.eclipse.parsson (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.parsson packages to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:16.290124173Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1781657690","title":"TuxCare security update for org.eclipse.parsson (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.parsson packages to address 2 CVEs. Fixed in 1.1.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-11-02T19:45:34.39880414Z","updated_at":"2026-11-02T20:30:13.950198Z"}]}}