CVE-2022-45690

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dromara/hutool/issues/2746Exploit, Issue Tracking, Third Party Advisory
https://github.com/stleary/JSON-java/issues/654Exploit, Issue Tracking, Third Party Advisory
https://github.com/dromara/hutool/issues/2746Exploit, Issue Tracking, Third Party Advisory
https://github.com/stleary/JSON-java/issues/654Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Dec 13, 2022
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-456937.5Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Deni CVE-2022-456977.8Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory.CVE-2022-456999.8Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitr CVE-2022-45705.4The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, CVE-2022-457018.8Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.CVE-2022-457037.8Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c.CVE-2022-457069.8IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the hostname parameter in the formSetNetCheckTools function.CVE-2022-457079.8IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsHijack function.CVE-2022-457089.8IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the sPortMapIndex parameter in the formDelPortMapping function CVE-2022-457099.8IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLevel, and pModule para CVE-2022-45715.4The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputti CVE-2022-457109.8IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pEnable, pLevel, and pModule parameters in the for