CVE-2023-1436: Jettison vulnerable to infinite recursion
Summary
CVE-2023-1436: Jettison vulnerable to infinite recursion. Affects org.codehaus.jettison:jettison versions < 1.5.4. Fixed in 1.5.4. How to fix ↓
Also tracked for
- libjettison-java · Debian:11
The same CVE-2023-1436 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jettison is a Java library that provides JSON support for Java applications. It allows developers to convert Java objects to JSON and vice versa. The library is commonly used in Maven projects. However, a vulnerability has been discovered in Jettison that can lead to an infinite recursion when constructing a JSONArray from a Collection containing a self-reference in one of its elements. This can result in a StackOverflowError exception being thrown.
Vulnerability Detail
The vulnerability in Jettison arises from a flaw in the construction of a JSONArray. When a Collection is used to create a JSONArray and one of the elements in the Collection contains a self-reference, an infinite recursion occurs. This leads to a StackOverflowError, which can cause the application to crash or become unresponsive. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.5.7 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the Jettison library is not immediately feasible, a workaround can be implemented by manually checking the Collection for self-references before constructing the JSONArray. This can be done by iterating over the elements of the Collection and comparing them to the parent object. If a self-reference is detected, the element should be excluded from the JSONArray construction process.
Conclusion
In conclusion, the Jettison library is vulnerable to an infinite recursion issue when constructing a JSONArray from a Collection with a self-reference. This can lead to a StackOverflowError and potential application crashes. It is recommended to update the Jettison library to version 1.5.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.codehaus.jettison:jettison →
FAQ
Jettison is a Java library that provides JSON support for Java applications. It allows developers to convert Java objects to JSON and vice versa.
The vulnerability can lead to an infinite recursion, causing a StackOverflowError and potentially crashing or freezing the application.
To fix the vulnerability, update the Jettison library to version 1.5.4 or later.
Yes, a workaround involves manually checking for self-references in the Collection before constructing the JSONArray.
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.codehaus.jettison:jettison.
