Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

CVE-2023-1370

What is CVE-2023-1370?

The Json-smart JSON processor library is susceptible to a stack exhaustion vulnerability due to the lack of limits on the nesting of arrays and objects during the parsing of JSON input. This flaw allows attackers to craft deeply nested structures that, when processed, can lead to a stack overflow condition. As a result, this can cause a denial-of-service scenario, effectively crashing the application that utilizes this library, disrupting normal operations and affecting service availability.

References