Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Maven package org.json:json versions before 20231013 are vulnerable to a denial of service. A specially crafted input string of modest size can cause the parser to consume unbounded memory and crash with an out-of-memory error. The advisory does not describe the attacker's access requirements. Upgrade to version 20231013 or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA (Google) |
- CISA KEV Not listed.
- EPSS 0.017, the 77th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:18 UTC First seen by agentprime
- 31 Oct 2026, 14:18 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-4jq9-2xhw-jpx7
- OSV: GHSA-4jq9-2xhw-jpx7
- github.com/google/security-research/security/advisories/GHSA-4jq9-2xhw-jpx7
- nvd.nist.gov/vuln/detail/CVE-2023-5072
- github.com/stleary/JSON-java/issues/758
- github.com/stleary/JSON-java/issues/771
- github.com/stleary/JSON-java/pull/759
- github.com/stleary/JSON-java/commit/60662e2f8384d3449822a3a1179bfe8de67b55bb
- github.com/stleary/JSON-java