cve.bz

CVE-2023-4043

7.5 highEPSS 0.8%

High (7.5) in eclipse parsson. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in org.eclipse.parsson:project 1.0.5, 1.1.4.

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWEs
CWE-834, CWE-20
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g8p6-p27c-52fxMavenorg.eclipse.parsson:project>=1.1.0 <1.1.41.1.4
GHSA-g8p6-p27c-52fxMavenorg.eclipse.parsson:project<1.0.51.0.5

References

Check your stackJSON