CVE-2023-34611

What it actually does

The parser in mjson accepts JSON objects containing cyclic references, which trigger unbounded recursion or resource exhaustion during deserialization and result in denial of service.

Why it matters to the business

Applications or services that ingest untrusted JSON can be crashed or made unresponsive, causing outages and degraded availability for any system relying on this library.

How an attack unfolds

An attacker crafts a JSON payload that contains circular object references and submits it over the network to any endpoint that uses the vulnerable mjson parser; the library enters infinite recursion, exhausting stack or CPU resources and crashing the process. Public exploit code is available, though no named threat actors have been observed using it.

How to fix it

Replace mjson with a maintained JSON library that enforces cycle detection or depth limits. If an upgrade path becomes available, update to the first patched release; otherwise implement input validation or a proxy that rejects deeply nested or cyclic structures before they reach the parser.

How to confirm the fix worked

Test the updated parser with known cyclic JSON payloads and confirm that recursion is terminated with an error rather than a crash; monitor process memory and CPU usage under load to verify stability.

Typical attack path

1. Identify a network-accessible endpoint or API that parses JSON with mjson
2. Generate or obtain a JSON payload containing cyclic object references
3. Transmit the malicious payload in a request to the target parser
4. Trigger resource exhaustion or crash, achieving denial of service

How to detect it

Review application and web-server logs for unusually large or deeply nested JSON request bodies; correlate with process crashes or high CPU events on hosts running mjson-based services. Examine any available exploit samples for characteristic cyclic structures.

What your security team should do

• Inventory all uses of mjson across the environment and prioritize replacement
• Apply network-level filtering or WAF rules to block abnormally nested JSON while remediation is in progress
• Add runtime monitoring for sudden spikes in parser CPU or memory consumption