Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-9563

org.eclipse.parsson/parsson: Eclipse Parsson: Denial of Service via uncontrolled resource consumption in JSON parsing

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Parsson
CVE-2023-7272

Eclipse Parsson stack overflow with deeply nested objects

In Eclipse Parsson before 1.0.4 and 1.1.3, a document with a large depth of nested objects can allow an attacker to cause a Java stack overflow exception and denial of service. Eclipse Parsson allows processing (e.g. parse, generate, transform and query) JSON documents.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Parsson
CVE-2023-4043

Parsson DoS when parsing numbers from untrusted sources

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Redhat
Products
Parsson Camel Quarkus Camel Spring Boot and 3 more