CVE-2023-7272

What it actually does

A JSON parser fails to limit recursion depth when processing documents containing deeply nested objects, causing a Java stack overflow exception that terminates the processing thread and results in denial of service.

Why it matters to the business

Applications or services that accept untrusted JSON input can be crashed or made unavailable, leading to service outages, degraded performance, and potential loss of revenue or operational continuity until the affected process is restarted.

How an attack unfolds

An attacker identifies an endpoint or API that accepts and parses JSON documents using the vulnerable library, crafts a payload with an extremely deep nesting level of objects, and transmits it over the network; the parser recurses until the stack is exhausted, triggering an unhandled exception and service disruption. No authentication or special privileges are required.

How to fix it

Upgrade eclipse-ee4j/parsson to a version containing commit 26d21a92839ad007fd60c74b0c41fe667935629d or later releases 1.0.4 and 1.1.3; implement input validation to reject or truncate overly deep JSON structures before parsing; consider deploying web application firewalls or request size limits as temporary controls.

How to confirm the fix worked

Verify the library version in dependency manifests or runtime classpaths against the fixed commit or releases; attempt to parse a test document with nesting depth exceeding 1000 levels and confirm the parser rejects it with a controlled error instead of a stack overflow.

Typical attack path

1. Locate a network-accessible interface that accepts JSON input processed by the vulnerable library
2. Generate or obtain a JSON document containing thousands of nested objects
3. Transmit the crafted document to the target endpoint
4. Observe the resulting stack overflow exception and denial of service

How to detect it

Review application and JVM logs for repeated StackOverflowError exceptions during JSON parsing; correlate with inbound HTTP requests containing unusually large or deeply nested JSON payloads; examine thread dumps or crash reports showing excessive recursion in parser methods.

What your security team should do

• Immediately inventory all applications using eclipse-ee4j/parsson and schedule upgrades to the fixed versions
• Add automated dependency scanning to CI/CD pipelines to prevent future vulnerable versions
• Monitor application logs and performance metrics for sudden spikes in stack-related exceptions or process restarts
• Apply network-level controls to limit maximum JSON nesting depth or payload complexity where feasible