CVE-2022-45685

Vulnerability

Details

CVE-2022-45685 is a stack overflow vulnerability in the Jettison Java library (versions before 1.5.2) used for converting between XML and JSON. The root cause is the lack of a recursion depth limit in the JSON parser when processing nested structures. An attacker can craft a JSON payload with an excessive number of opening braces (e.g., {{{{...), causing the parser to recurse deeply and throw a StackOverflowError [1][2]. The official fix introduced a default recursion depth limit of 500, configurable via JSONObject.setGlobalRecursionDepthLimit() [3].

Exploitation

The attack surface includes any application that parses untrusted JSON using Jettison. No authentication or special network position is required; the attacker simply sends a specially crafted JSON string to the vulnerable endpoint. The proof-of-concept provided in the issue tracker demonstrates a string of hundreds of nested braces that triggers the overflow [1]. The vulnerability is triggered during parsing, before any data validation can occur.

Impact

Successful exploitation results in a denial of service (DoS) condition. The JVM thread processing the malicious JSON crashes due to the stack overflow, potentially causing the application to become unresponsive or terminate. This can be repeated to sustain a DoS attack.

Mitigation

The vulnerability is fixed in Jettison version 1.5.2, which enforces a default recursion depth limit of 500 [3]. Users are advised to upgrade to this version or later. For applications that cannot upgrade immediately, the recursion depth limit can be set globally using the provided API. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.