Skip to content
Fencer Vulns
high 7.5

CVE-2024-57699 json

Netplex Json-smart Uncontrolled Recursion vulnerability

published 2025-02-05 21 mo ago modified 2026-09-10 1 mo ago also GHSA-pq2g-wx69-c263 , EUVD-2024-53713

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.

Patch / fix

  • maven net.minidev:json-smart 2.5.2
  • json-smart Debian 14, Debian 13 2.5.2-1

debian advisories DEBIAN-CVE-2024-57699

  • jenkins ocp tools 4.14 2.504.2.1750903189-3.el8
  • jenkins-2-plugins ocp tools 4.14 4.14.1750903529-1.el8
  • jenkins ocp tools 4.13 2.504.2.1750916374-3.el8
  • jenkins-2-plugins ocp tools 4.13 4.13.1750916671-1.el8
  • jenkins ocp tools 4.12 2.504.2.1750932984-3.el8
  • jenkins-2-plugins ocp tools 4.12 4.12.1750933270-1.el8
  • jenkins ocp tools 4.15 2.504.2.1750856366-3.el8
  • jenkins-2-plugins ocp tools 4.15 4.15.1750856638-1.el8

red hat advisories RHSA-2025:10120RHSA-2025:10119RHSA-2025:10118RHSA-2025:10104RHSA-2025:10098RHSA-2025:10097

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-57699 updated cvss 7.5

json-smart: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370)

  • Red Hat build of Apicurio Registry 2 json-smart
    affected: workaround, no fix planned “Red Hat Product Security does not have a recommended mitigation at this time.”
  • Red Hat build of Debezium 2 json-smart
    affected: workaround, no fix available “Red Hat Product Security does not have a recommended mitigation at this time.”
  • Red Hat Data Grid 8 json-smart Red Hat Fuse 7 json-smart, json-smart-action, net.minidev-json-smart
    affected: workaround, no fix planned “Red Hat Product Security does not have a recommended mitigation at this time.”
  • Red Hat streams for Apache Kafka json-smart, json-smart-action, net.minidev-json-smart
    affected: workaround, no fix available, no fix planned “Red Hat Product Security does not have a recommended mitigation at this time.”
  • Red Hat streams for Apache Kafka 2 json-smart
    affected: workaround, no fix available “Red Hat Product Security does not have a recommended mitigation at this time.”
  • Red Hat HawtIO HawtIO 4.2.0
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:8761
  • Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.504.2.1750932984-3.el8, jenkins-2-plugins 4.12.1750933270-1.el8
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10118
  • Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.504.2.1750916374-3.el8, jenkins-2-plugins 4.13.1750916671-1.el8
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10119
show 10 more
  • Red Hat OpenShift Developer Tools and Services for OCP 4.14 jenkins 2.504.2.1750903189-3.el8, jenkins-2-plugins 4.14.1750903529-1.el8
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10120
  • Red Hat OpenShift Developer Tools and Services for OCP 4.15 jenkins 2.504.2.1750856366-3.el8, jenkins-2-plugins 4.15.1750856638-1.el8
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10104
  • Red Hat OpenShift Developer Tools and Services for OCP 4.16 jenkins 2.504.2.1750857144-3.el9, jenkins-2-plugins 4.16.1750857315-1.el9
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10098
  • Red Hat OpenShift Developer Tools and Services for OCP 4.17 jenkins 2.504.2.1750851690-3.el9, jenkins-2-plugins 4.17.1750851950-1.el9
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10097
  • Red Hat OpenShift Developer Tools and Services for OCP 4.18 jenkins 2.504.2.1750846524-3.el9, jenkins-2-plugins 4.18.1750846854-1.el9
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10092
  • Red Hat Build of Apache Camel 4.8 for Quarkus 3.15
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:3541
  • Red Hat build of Apache Camel 4.8.5 for Spring Boot
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:3543
  • Red Hat A-MQ Clients 2 json-smart Red Hat Logging Subsystem for Red Hat OpenShift json-smart Red Hat AMQ Clients json-smart
    not affected: vulnerable code not present
  • Red Hat build of Apache Camel 4 for Quarkus 3 quarkus-cxf-bom
    not affected: component not present
  • Red Hat build of Apicurio Registry 3 json-smart Red Hat build of OptaPlanner 8 json-smart Red Hat Integration Camel K 1 json-smart, json-smart-action Red Hat JBoss Enterprise Application Platform 7 json-smart Red Hat JBoss Enterprise Application Platform 8 json-smart, net.minidev-json-smart Red Hat JBoss Enterprise Application Platform Expansion Pack json-smart, net.minidev-json-smart
    +2 more products
    Red Hat Process Automation 7 json-smart Red Hat Single Sign-On 7 json-smart
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven net.minidev:json-smart
>=2.5.0, <2.5.2
2.5.2

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.