{"cve":"CVE-2023-33008","nvd":{"published":"2023-07-07T10:15:09.487","modified":"2026-06-17T06:00:16.577","status":"Modified","description":"Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.\n\n\nA malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. \n\n\nThis issue affects Apache Johnzon: through 1.2.20.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cwes":["CWE-502"],"references":["https://lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l","https://lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l"],"products":["apache:johnzon"],"source":"nvd","synced_at":"2026-10-19T21:38:30.124994567+00:00"},"epss":{"cve":"CVE-2023-33008","score":0.01442,"percentile":0.73237,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-crqg-jrpj-fc84","url":"https://osv.dev/vulnerability/GHSA-crqg-jrpj-fc84","summary":"Apache Johnzon Deserialization of Untrusted Data vulnerability","modified":"2024-02-16T08:00:08.359623Z","packages":[{"ecosystem":"Maven","name":"org.apache.johnzon:johnzon-mapper","purl":"pkg:maven/org.apache.johnzon/johnzon-mapper","ranges":["<1.2.21"],"fixed":["1.2.21"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}