Skip to content
Fencer Vulns
high 7.5

CVE-2023-5072 json

DoS Vulnerability in JSON-Java

published 2023-10-12 3 y ago modified 2026-09-10 1 mo ago also GHSA-4jq9-2xhw-jpx7 , EUVD-2023-2880

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

Patch / fix

  • maven org.json:json 20231013
  • libjson-java Debian 14, Debian 13 3.1.0+dfsg-1

debian advisories DEBIAN-CVE-2023-5072

  • openjdk17 Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 17.0.10_p7-r0
  • openjdk21 Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 21.0.2_p13-r0

alpine advisories ALPINE-CVE-2023-5072

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-5072 updated cvss 7.5

JSON-java: parser confusion leads to OOM

  • Red Hat build of Apicurio Registry 2 JSON-java JSON-java Red Hat Decision Manager 7 JSON-java JSON-java Red Hat Integration Camel Quarkus 2 JSON-java JSON-java
    affected: workaround, no fix available “No current mitigation is available for this flaw.”
  • Red Hat JBoss Data Grid 7 JSON-java JSON-java Red Hat JBoss Enterprise Application Platform 6 json Red Hat JBoss Fuse 6 JSON-java JSON-java Red Hat JBoss Fuse Service Works 6 JSON-java JSON-java
    affected: workaround, no fix planned “No current mitigation is available for this flaw.”
  • Red Hat AMQ Broker 7
    fixed: vendor fix “No current mitigation is available for this flaw.” RHSA-2024:3752
  • Red Hat AMQ Streams 2.6.0
    fixed: vendor fix “No current mitigation is available for this flaw.” RHSA-2023:7678
  • Red Hat build of Apache Camel 4 for Quarkus 3
    fixed: vendor fix “No current mitigation is available for this flaw.” RHSA-2023:7617
  • Red Hat Fuse 7.13.0
    fixed: vendor fix “No current mitigation is available for this flaw.” RHSA-2024:3354
  • Red Hat RHINT Camel-K 1.10.5
    fixed: vendor fix “No current mitigation is available for this flaw.” RHSA-2024:0148
  • Red Hat RHINT Camel-Springboot 3.20.4
    fixed: vendor fix “No current mitigation is available for this flaw.” RHSA-2023:7845
show 3 more
  • Red Hat RHINT Camel-Springboot 4.0.2
    fixed: vendor fix “No current mitigation is available for this flaw.” RHSA-2023:7842
  • Red Hat RHPAM 7.13.5 async
    fixed: vendor fix “No current mitigation is available for this flaw.” RHSA-2024:1353
  • Red Hat OpenShift Serverless JSON-java JSON-java Red Hat Ansible Automation Platform 2 JSON-java Red Hat build of Debezium 2 JSON-java JSON-java Red Hat Data Grid 8 JSON-java JSON-java Red Hat JBoss Enterprise Application Platform 7 json Red Hat JBoss Enterprise Application Platform 8 json
    +3 more products
    Red Hat JBoss Enterprise Application Platform Expansion Pack JSON-java JSON-java Red Hat Single Sign-On 7 JSON-java JSON-java Red Hat streams for Apache Kafka JSON-java JSON-java
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
23 mo ago

Exploit prediction

1.74% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/stleary/JSON-java/issues/771 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.json:json
<20231013
20231013

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-358 Improperly Implemented Security Check for Standard

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.