CVE-2023-51075: Denial of Service (DoS) in cn.hutool:hutool-core
Summary
CVE-2023-51075: hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function. Affects cn.hutool:hutool-core versions < 5.8.24. Fixed in 5.8.24. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
cn.hutool:hutool-core is a Maven package that provides a set of utility classes for Java development. It offers various functionalities such as string manipulation, file handling, encryption, and more. The package is widely used in Java applications for simplifying common tasks and improving development efficiency. However, a vulnerability has been discovered in version 5.8.23 of hutool-core, which can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in hutool-core version 5.8.23 lies in the StrSplitter.splitByRegex function. Attackers can exploit this vulnerability by manipulating the first two parameters, causing an infinite loop. This can result in a DoS condition, where the application becomes unresponsive or crashes due to excessive resource consumption. The impact of this vulnerability can be severe, as it can disrupt the availability of the affected application and potentially affect the overall system stability.
How To Fix
Latest published version: 5.8.48 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.8.24
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually modify the affected function in the hutool-core library to prevent the infinite loop. Here is an example of how the function can be modified:
// Original vulnerable code
public static List<String> splitByRegex(String str, String regex, int limit) {
// Vulnerable code with infinite loop
...
}
// Modified code to fix the vulnerability
public static List<String> splitByRegex(String str, String regex, int limit) {
// Fixed code
...
}
It is important to note that applying this workaround may introduce other issues or break compatibility with future updates of the hutool-core library. Therefore, it is recommended to apply the official fix by upgrading to a patched version of the package.
Conclusion
The vulnerability in cn.hutool:hutool-core version 5.8.23 can lead to a Denial of Service (DoS) attack. It is crucial for developers to upgrade to version 5.8.24 or later to mitigate the risk. Applying the official fix ensures that the StrSplitter.splitByRegex function no longer contains the infinite loop vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for cn.hutool:hutool-core →
FAQ
This vulnerability can lead to a Denial of Service (DoS) condition in applications that use the vulnerable version of hutool-core. Attackers can exploit the vulnerability to cause excessive resource consumption, resulting in application unresponsiveness or crashes.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your pom.xml file and provides real-time alerts for open-source vulnerabilities.
Yes, a workaround is available by manually modifying the affected function in the hutool-core library. However, it is recommended to apply the official fix by upgrading to a patched version of the package to avoid potential compatibility issues.
To fix this vulnerability, you should upgrade the hutool-core package to version 5.8.24 or later. This can be done by updating the dependency version in your project's Maven configuration file (pom.xml) and rebuilding the application.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-7m7h-rgvp-3v4r/GHSA-7m7h-rgvp-3v4r.json
References
Related vulnerabilities
Recent vulnerabilities recorded for cn.hutool:hutool-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
