CVE-2023-33008

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.

A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal.

This issue affects Apache Johnzon: through 1.2.20.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jul 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-330099.8A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX serie CVE-2023-33015.6A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-n CVE-2023-330109.8A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX seri CVE-2023-330118.8A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 th CVE-2023-330128.8A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX CVE-2023-330138.8A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01(ABIR.1)C0 could allow an au CVE-2023-330146.8Information disclosure in Core services while processing a Diag command.CVE-2023-330157.5Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.CVE-2023-330167.5Transient DOS in WLAN firmware while parsing MLO (multi-link operation).CVE-2023-330177.8Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.CVE-2023-330187.8Memory corruption while using the UIM diag command to get the operators name.CVE-2023-330197.5Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.