CVE-2022-45689: hutool-json Memory Exhaustion Vulnerability
Summary
CVE-2022-45689: hutool-json vulnerable to memory exhaustion. Affects cn.hutool:hutool-json versions < 5.8.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
hutool-json is a JSON processing library for the Java programming language. It provides various utility methods for working with JSON data. The library is commonly used in Maven projects with the package name 'cn.hutool:hutool-json'. Unfortunately, version 5.8.10 of hutool-json has been found to contain a memory exhaustion vulnerability.
Vulnerability Detail
The memory exhaustion vulnerability in hutool-json version 5.8.10 can lead to out of memory errors. This issue is similar to CVE-2022-45690. An attacker can exploit this vulnerability by sending specially crafted JSON data to an application that uses hutool-json, causing the application to consume excessive memory and potentially crash. This vulnerability has a low severity rating.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
hutool-json version 5.8.10 has a memory exhaustion vulnerability that can lead to out of memory errors. It is recommended to upgrade to a non-affected version of hutool-json to mitigate this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for cn.hutool:hutool-json →
FAQ
hutool-json is a JSON processing library for Java that provides utility methods for working with JSON data.
This vulnerability can lead to out of memory errors and potential application crashes.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will analyze it for vulnerabilities.
Yes, upgrading to a version of hutool-json that is not affected by this vulnerability will fix the issue.
The latest version of hutool-json can be found on the Maven Central Repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for cn.hutool:hutool-json.
