Maven package
cn.hutool/hutool-core
pkg:maven/cn.hutool/hutool-core
Vulnerabilities (9)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-51080 | — | >= 5.8.22, < 5.8.25 | 5.8.25 | Dec 27, 2023 | The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow. | ||
| CVE-2023-51075 | — | < 5.8.24 | 5.8.24 | Dec 27, 2023 | hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial of Service (DoS) via manipulation of the first two parameters. | ||
| CVE-2023-42278 | — | < 5.8.22 | 5.8.22 | Sep 8, 2023 | hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse(). | ||
| CVE-2023-42277 | — | <= 5.8.21 | — | Sep 8, 2023 | hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath. | ||
| CVE-2023-42276 | — | <= 5.8.21 | — | Sep 8, 2023 | hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray. | ||
| CVE-2023-3276 | — | <= 5.8.19 | — | Jun 15, 2023 | A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit | ||
| CVE-2023-33695 | — | < 5.8.19 | 5.8.19 | Jun 13, 2023 | Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java. | ||
| CVE-2022-4565 | — | < 5.8.11 | 5.8.11 | Dec 16, 2022 | A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.ZipUtil.java. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been dis | ||
| CVE-2018-17297 | — | < 4.1.12 | 4.1.12 | Sep 21, 2018 | The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive. |
- CVE-2023-51080Dec 27, 2023affected >= 5.8.22, < 5.8.25fixed 5.8.25
The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.
- CVE-2023-51075Dec 27, 2023affected < 5.8.24fixed 5.8.24
hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial of Service (DoS) via manipulation of the first two parameters.
- CVE-2023-42278Sep 8, 2023affected < 5.8.22fixed 5.8.22
hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
- CVE-2023-42277Sep 8, 2023affected <= 5.8.21
hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.
- CVE-2023-42276Sep 8, 2023affected <= 5.8.21
hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.
- CVE-2023-3276Jun 15, 2023affected <= 5.8.19
A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit
- CVE-2023-33695Jun 13, 2023affected < 5.8.19fixed 5.8.19
Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.
- CVE-2022-4565Dec 16, 2022affected < 5.8.11fixed 5.8.11
A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.ZipUtil.java. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been dis
- CVE-2018-17297Sep 21, 2018affected < 4.1.12fixed 4.1.12
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.