Medium severity5.9NVD Advisory· Published Mar 22, 2023· Updated Jun 17, 2026
CVE-2023-1436
CVE-2023-1436
Description
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.codehaus.jettison:jettisonMaven | < 1.5.4 | 1.5.4 |
Affected products
9- jettison/jettisonv5Range: 0
- osv-coords7 versionspkg:rpm/opensuse/jettison&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/jettison&distro=openSUSE%20Tumbleweedpkg:apk/wolfi/druid-compatpkg:apk/chainguard/druid-compatpkg:maven/org.codehaus.jettison/jettisonpkg:apk/chainguard/druidpkg:apk/wolfi/druid
< 1.5.4-150200.3.7.1+ 6 more
- (no CPE)range: < 1.5.4-150200.3.7.1
- (no CPE)range: < 1.5.4-1.1
- (no CPE)range: < 34.0.0-r6
- (no CPE)range: < 34.0.0-r6
- (no CPE)range: < 1.5.4
- (no CPE)range: < 35.0.1-r5
- (no CPE)range: < 35.0.1-r5
Patches
Vulnerability mechanics
References
7- research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/nvdExploitThird Party Advisory
- github.com/advisories/GHSA-q6g2-g7f3-rr83ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-1436ghsaADVISORY
- github.com/jettison-json/jettison/issues/60ghsaWEB
- github.com/jettison-json/jettison/pull/62ghsaWEB
- github.com/jettison-json/jettison/releases/tag/jettison-1.5.4ghsaWEB
- research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911ghsaWEB
News mentions
0No linked articles in our index yet.