Hutool vulnerabilities

Products

• Hutool 15

Newest

• hutool Hutool allows remote code execution (RCE) via the QLExpressEngine class CVE-2025-56769 Fix available 6.5 MediumSeptember 25, 2025
• hutool hutool-core was discovered to contain a stack overflow via NumberUtil.toBigDecimal method CVE-2023-51080 Fix available 7.5 HighDecember 27, 2023
• hutool hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function CVE-2023-51075 Fix available 7.5 HighDecember 27, 2023
• hutool hutool Buffer Overflow vulnerability CVE-2023-42278 Fix available 7.5 HighSeptember 8, 2023
• hutool hutool Buffer Overflow vulnerability CVE-2023-42277 9.8 CriticalSeptember 8, 2023
• hutool hutool Buffer Overflow vulnerability CVE-2023-42276 9.8 CriticalSeptember 8, 2023
• hutool Insecure Temporary File in HuTool CVE-2023-33695 Fix available 7.1 HighJune 13, 2023
• hutool Dromara hutool vulnerable to SQL Injection CVE-2023-24163 Fix available 9.8 CriticalJanuary 31, 2023
• hutool Dromara Hutool Deserialization of Untrusted Data vulnerability CVE-2023-24162 9.8 CriticalJanuary 31, 2023
• dromara hutool Dromara HuTool cn.hutool.core.util.ZipUtil.java resource consumption CVE-2022-4565 Fix available 4.3 MediumDecember 16, 2022
• hutool, stleary json-java +1 more hutool-json stack overflow vulnerability CVE-2022-45690 Fix available 7.5 HighDecember 13, 2022
• hutool hutool-json vulnerable to memory exhaustion CVE-2022-45689 7.5 HighDecember 13, 2022
• hutool, stleary json-java +1 more json stack overflow vulnerability CVE-2022-45688 Public exploitFix available 7.5 HighDecember 13, 2022
• hutool Improper Certificate Validation in Hutool CVE-2022-22885 Fix available 9.8 CriticalFebruary 16, 2022
• hutool Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal CVE-2018-17297 Public exploitFix available 7.5 HighSeptember 21, 2018