Security Exception in com.github.javaparser.GeneratedJavaParser.Expression

javaparser Updated 02 Oct 2025

Summary

28/09/2023

Disclosed on

LOW

Severity

Yes i

Fix available

Low

Severity

Not published

CVSS Score

OSV-2023-920: Security exception in com.github.javaparser.GeneratedJavaParser.Expression. Affects javaparser versions >= 25139c9f1010f3063789b75c04471de90bd5cf8a, < 6fa0a76ac8727fd1ee8ba90d138a932c81a21ab5. Fixed in 6fa0a76ac8727fd1ee8ba90d138a932c81a21ab5. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The package under scrutiny is javaparser, an open-source library for parsing Java source code. It provides functionality to parse, analyze, and manipulate Java code. The vulnerability affects the Expression class in the GeneratedJavaParser module of the library.

Vulnerability Detail

The vulnerability is a security exception that occurs in the Expression class of the GeneratedJavaParser module. It has been reported through the OSS-Fuzz project. The crash state indicates that the exception is triggered during the encoding process in the CESU_8$Encoder class of the Java base library. The severity of this vulnerability is assessed as LOW. The vulnerability can potentially lead to crashes or other security issues when processing certain input.

How To Fix

Minimum fixed version

6fa0a76ac8727fd1ee8ba90d138a932c81a21ab5

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

No workaround has been mentioned for this vulnerability.

Conclusion

In conclusion, the javaparser library is affected by a security exception vulnerability in the Expression class of the GeneratedJavaParser module. Users are advised to update their dependency to a fixed version to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for javaparser →

FAQ

What is the impact of this vulnerability?

The impact of this vulnerability can vary depending on the usage of the javaparser library. It can potentially lead to crashes or other security issues when processing certain input.

How can I check if my application is affected by this vulnerability?

You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes the manifest file (e.g., package-lock.json) of your application to identify and alert in real-time for open-source vulnerabilities.