High severity · published Aug 19, 2022
CVE-2022-23460
Stack overflow in Jsonxx
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized (ASAN) build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the current commit of the jsonxx project and the project itself has been archived. Updates are not expected. Users are advised to find a replacement.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jsonxx · hjiang
through 1.0.1 · source: vendor
JS
Json++ · Hjiang
1.0.0; 1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23460
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23460
Broken Link
https://securitylab.github.com/advisories/GHSL-2022-049_Jsonxx
More from Jsonxx
9.8
CVE-2022-23459
Double free or Use after Free in Value class of Jsonxx
