CVE-2022-45685: Jettison Out-of-bounds Write vulnerability
Summary
CVE-2022-45685: Jettison Out-of-bounds Write vulnerability. Affects org.codehaus.jettison:jettison versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Also tracked for
- libjettison-java · Debian:11
The same CVE-2022-45685 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jettison is a library that provides JSON support for Java. It allows developers to convert Java objects to JSON and vice versa. The library is commonly used in Maven projects. However, versions prior to 1.5.2 are vulnerable to an out-of-bounds write issue.
Vulnerability Detail
The vulnerability in Jettison before version 1.5.2 is an out-of-bounds write vulnerability. Attackers can exploit this vulnerability by providing crafted JSON data, which triggers a stack overflow. This can lead to a Denial of Service (DoS) attack, causing the application to crash or become unresponsive. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 1.5.7 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Jettison library to the fixed version.
Conclusion
The Jettison library prior to version 1.5.2 is vulnerable to an out-of-bounds write issue. This vulnerability can be exploited to cause a Denial of Service (DoS) attack. It is crucial to update the library to version 1.5.2 or later to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.codehaus.jettison:jettison →
FAQ
Jettison is a Java library that provides JSON support for Java applications. It allows developers to convert Java objects to JSON and vice versa.
The vulnerability can be exploited by attackers to cause a Denial of Service (DoS) attack, leading to application crashes or unresponsiveness.
To fix this vulnerability, you need to update the Jettison library to version 1.5.2 or later. Modify the pom.xml file in your Maven project to use the updated version.
No, there is no known workaround for this vulnerability. Updating the library to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.codehaus.jettison:jettison.
