CVE-2024-57699

What it actually does

CVE-2024-57699 is a denial-of-service vulnerability in Netplex Json-smart versions 2.5.0 through 2.5.1. The JSON parser can exhaust the application stack when processing specially crafted JSON containing a very large number of opening braces. Because parsing occurs before normal application logic completes, any service that accepts attacker-controlled JSON and parses it with affected Json-smart versions may experience thread failure, request handling disruption, or process instability. The issue is remotely triggerable, requires no authentication or user interaction, and primarily affects availability; confidentiality and integrity are not directly impacted.

Why it matters to the business

Applications, APIs, gateways, and backend services that parse untrusted JSON with affected Json-smart versions can be forced into service degradation or outage by malformed input. For internet-facing systems, this can translate into failed transactions, degraded customer experience, increased support load, and potential cascading failures if dependent services retry or queue failed requests. The vulnerability is not listed in CISA KEV, has low EPSS at the time of assessment, and has no known mature public exploitation, but the attack is simple enough that exposed JSON-processing endpoints should still be remediated during normal patch cycles or faster for critical public services.

How an attack unfolds

An attacker identifies an application endpoint that accepts JSON input and is backed by an affected Json-smart parser. The attacker sends a request body containing deeply nested or malformed JSON with an excessive number of opening braces. During parsing, Json-smart recursively processes the structure until the Java call stack is exhausted. This can produce StackOverflowError conditions, terminate request-handling threads, trigger repeated exceptions, consume resources, or destabilize the service. By repeating requests or targeting high-traffic endpoints, the attacker can amplify the impact into a sustained denial of service.

How to fix it

Upgrade Netplex Json-smart to a version that contains the complete fix for this stack-exhaustion issue. The reported affected range is Json-smart 2.5.0 through 2.5.1; avoid these versions in direct and transitive dependencies. If exact fixed versions are not provided by the package inventory, consult the upstream Json-smart release notes and dependency metadata, then pin to a non-affected release. Rebuild and redeploy applications after dependency updates. As compensating controls, enforce maximum request body size, maximum JSON nesting depth where supported, API gateway limits, parser timeouts, rate limiting, and request validation for endpoints that accept untrusted JSON. Ensure exception handling for parser failures returns controlled errors without destabilizing worker processes.

How to confirm the fix worked

Confirm exposure by generating a software bill of materials or dependency tree and checking for net.minidev:json-smart versions 2.5.0 or 2.5.1, including transitive dependencies. Validate remediation by confirming the deployed artifact no longer contains affected Json-smart versions and by running integration tests against JSON endpoints with deeply nested or malformed brace-heavy input. The expected post-fix behavior is controlled rejection, validation failure, or a bounded parser exception without stack exhaustion, service crash, sustained CPU/resource exhaustion, or repeated HTTP 5xx responses. Also verify gateway and application limits for request size and JSON depth are enforced consistently across public and internal JSON-consuming endpoints.

Typical attack path

1. Identify an application, API, or service endpoint that accepts JSON request bodies.
2. Send probe requests with increasingly deep or malformed JSON structures containing many opening braces.
3. Observe timeout, HTTP 5xx responses, connection resets, or degraded service behavior indicating parser failure.
4. Automate repeated delivery of the crafted payload to exhaust request-handling capacity or destabilize the service.
5. Maintain pressure against exposed endpoints to prolong application unavailability or trigger cascading failures in dependent systems.

How to detect it

To assess prior exploitation, review web server, API gateway, WAF, application, and Java runtime logs for requests with unusually large or deeply nested JSON bodies, especially bodies dominated by repeated opening braces. Look for correlated application errors such as java.lang.StackOverflowError, parser exceptions from Json-smart or net.minidev classes, sudden increases in HTTP 500 responses, request timeouts, thread termination messages, container restarts, or health-check failures. Because denial-of-service exploitation may not leave a persistent file artifact, detection is mainly behavioral: short bursts or sustained waves of malformed JSON requests followed by service instability. Prioritize logs for public JSON endpoints and time windows with unexplained availability incidents. If request-body logging is enabled in a WAF or gateway, search for long sequences of "{" characters and abnormal content-length values on JSON endpoints.

• java.lang.StackOverflowError
• net.minidev.json
• json-smart
• ParseException
• Unexpected token
• HTTP 500
• HTTP 413
• Content-Type: application/json
• {{{{{{{{{{{{{{{{{{{{
• StackOverflowError.*net.minidev
• net.minidev.json.parser
• net.minidev.json.JSONValue
• application/json.*\{\{\{\{\{

What your security team should do

• Inventory applications and services that include Netplex Json-smart, especially Java services that expose JSON APIs to untrusted clients.
• Prioritize remediation for internet-facing APIs, authentication-adjacent services, high-availability business systems, and services where retry storms could create cascading impact.
• Upgrade or override transitive dependencies so Json-smart 2.5.0 and 2.5.1 are not present in deployed artifacts.
• Add or verify API gateway and application-layer limits for request body size, JSON nesting depth, request rate, and parser execution behavior.
• Search application and web logs for recent spikes in malformed JSON errors, StackOverflowError events, HTTP 400/413/500 responses, timeouts, and request bursts with unusually large brace-heavy bodies.
• Add regression tests for deeply nested malformed JSON to prevent reintroduction through future dependency changes.
• Monitor upstream advisories because this issue is described as an incomplete fix for an earlier vulnerability, indicating similar parser edge cases may exist across nearby versions.