CVE-2023-1436
published 2023-03-22CVE-2023-1436: An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This…
PriorityP434high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.01%
59.7th percentile
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | jira_software | — | — |
| debian | libjettison-java | < libjettison-java 1.5.4-1 (forky) | libjettison-java 1.5.4-1 (forky) |
| jettison | jettison | < 1.5.4 | 1.5.4 |
| jettison_project | jettison | < 1.5.4 | 1.5.4 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_oracle7.5MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (jackson-databind) — CVE-2023-1436
vendor_oracle·2024-07-15·CVSS 7.5
CVE-2023-1436 [MEDIUM] Oracle Oracle Analytics Risk Matrix: Analytics Server (jackson-databind) — CVE-2023-1436
Oracle Oracle Analytics Risk Matrix: Analytics Server (jackson-databind) vulnerability
CVE: CVE-2023-1436
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Oracle
Oracle Oracle Retail Applications Risk Matrix: Security (Jettison) — CVE-2023-1436
vendor_oracle·2024-04-15·CVSS 7.5
CVE-2023-1436 [MEDIUM] Oracle Oracle Retail Applications Risk Matrix: Security (Jettison) — CVE-2023-1436
Oracle Oracle Retail Applications Risk Matrix: Security (Jettison) vulnerability
CVE: CVE-2023-1436
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Atlassian
CVE-2023-1436: DoS (Denial of Service) org.codehaus.jettison:jettison Dependency in Jira Software Data Center and Server
vendor_atlassian·2024-03-19·CVSS 7.5
CVE-2023-1436 [MEDIUM] CVE-2023-1436: DoS (Denial of Service) org.codehaus.jettison:jettison Dependency in Jira Software Data Center and Server
CVE-2023-1436: DoS (Denial of Service) org.codehaus.jettison:jettison Dependency in Jira Software Data Center and Server
DoS (Denial of Service) org.codehaus.jettison:jettison Dependency in Jira Software Data Center and Server
CVE: CVE-2023-1436
Affected products: Jira Software
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Agent Next Gen (Jettison) — CVE-2023-1436
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2023-1436 [MEDIUM] Oracle Oracle Enterprise Manager Risk Matrix: Agent Next Gen (Jettison) — CVE-2023-1436
Oracle Oracle Enterprise Manager Risk Matrix: Agent Next Gen (Jettison) vulnerability
CVE: CVE-2023-1436
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Oracle
Oracle Oracle GoldenGate Risk Matrix: GoldenGate Studio (Jettison) — CVE-2023-1436
vendor_oracle·2023-10-15·CVSS 7.5
CVE-2023-1436 [MEDIUM] Oracle Oracle GoldenGate Risk Matrix: GoldenGate Studio (Jettison) — CVE-2023-1436
Oracle Oracle GoldenGate Risk Matrix: GoldenGate Studio (Jettison) vulnerability
CVE: CVE-2023-1436
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle Communications Applications Risk Matrix: BRM Server (Jettison) — CVE-2023-1436
vendor_oracle·2023-07-15·CVSS 7.5
CVE-2023-1436 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: BRM Server (Jettison) — CVE-2023-1436
Oracle Oracle Communications Applications Risk Matrix: BRM Server (Jettison) vulnerability
CVE: CVE-2023-1436
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Ubuntu
Jettison vulnerability
vendor_ubuntu·2023-06-20
CVE-2023-1436 Jettison vulnerability
Title: Jettison vulnerability
Summary: Jettison could be made to crash if it opened a specially crafted
file.
It was discovered that Jettison incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
jettison: Uncontrolled Recursion in JSONArray
vendor_redhat·2023-03-22·CVSS 5.9
CVE-2023-1436 [MEDIUM] CWE-674 jettison: Uncontrolled Recursion in JSONArray
jettison: Uncontrolled Recursion in JSONArray
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
A flaw was found in Jettison. Infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This issue leads to a StackOverflowError exception being thrown.
Package: jettison (A-MQ Clients 2) - Not affected
Package: openshift-logging/elasticsearch6-rhel8 (Logging Subsystem for Red Hat OpenShift) - Affected
Package: jettison (Red Hat Data Grid 8) - Not affected
Package: jettison (Red Hat Decision Manager 7) - Out of support scope
Package: jettison (R
Debian
CVE-2023-1436: libjettison-java - An infinite recursion is triggered in Jettison when constructing a JSONArray fro...
vendor_debian·2023·CVSS 5.9
CVE-2023-1436 [MEDIUM] CVE-2023-1436: libjettison-java - An infinite recursion is triggered in Jettison when constructing a JSONArray fro...
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.5.4-1)
sid: resolved (fixed in 1.5.4-1)
trixie: resolved (fixed in 1.5.4-1)
VulDB
Jettison JSON Array recursion (Nessus ID 309923)
vuldb·2026-04-24·CVSS 7.5
CVE-2023-1436 [HIGH] Jettison JSON Array recursion (Nessus ID 309923)
A vulnerability classified as critical has been found in Jettison. This vulnerability affects unknown code of the component JSON Array Handler. The manipulation leads to uncontrolled recursion.
This vulnerability is listed as CVE-2023-1436. The attack may be initiated remotely. There is no available exploit.
OSV
CVE-2023-1436: An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements
osv·2023-03-22·CVSS 7.5
CVE-2023-1436 [HIGH] CVE-2023-1436: An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
OSV
Jettison vulnerable to infinite recursion
osv·2023-03-22
CVE-2023-1436 [HIGH] Jettison vulnerable to infinite recursion
Jettison vulnerable to infinite recursion
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
GHSA
Jettison vulnerable to infinite recursion
ghsa·2023-03-22
CVE-2023-1436 [HIGH] CWE-674 Jettison vulnerable to infinite recursion
Jettison vulnerable to infinite recursion
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
No detection rules found.
No public exploits indexed.
2023-03-22
Published