CVE-2022-45690: hutool-json stack overflow vulnerability
Summary
CVE-2022-45690: hutool-json stack overflow vulnerability. Affects cn.hutool:hutool-json versions < 5.8.11. Fixed in 5.8.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The hutool-json package is a JSON processing library for Java applications. It provides various utility methods for parsing, manipulating, and generating JSON data. This vulnerability affects hutool-json version 5.8.10 and below.
Vulnerability Detail
A stack overflow vulnerability exists in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json. Attackers can exploit this vulnerability by providing crafted JSON or XML data, leading to a Denial of Service (DoS) condition. The vulnerability allows an attacker to overflow the stack, potentially crashing the application or causing it to become unresponsive.
How To Fix
Latest published version: 5.8.48 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.8.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
The hutool-json stack overflow vulnerability (CVE-2022-45690) allows attackers to cause a Denial of Service (DoS) by providing crafted JSON or XML data. It is recommended to upgrade to hutool-json version 5.8.11 or later to fix this vulnerability. No known workarounds are available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cn.hutool:hutool-json →
FAQ
This vulnerability can lead to a Denial of Service (DoS) condition, potentially causing the affected application to crash or become unresponsive.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
At the time of this advisory, there are no known exploits for this vulnerability. However, it is still important to upgrade to the fixed version to mitigate the risk.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
For more information about this vulnerability, you can contact info@devnack.com or visit the Vulert website at https://vulert.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for cn.hutool:hutool-json.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
