GHSA-5x5q-8cgm-2hjq

What it actually does

Karate core versions before 1.4.0 include a vulnerable json-smart dependency affected by CVE-2023-1370. The underlying parser can recurse excessively when processing specially crafted, deeply nested JSON structures, leading to stack exhaustion and a Java StackOverflowError. If an application, service, test runner, automation endpoint, or embedded workflow processes attacker-controlled JSON through the vulnerable Karate/json-smart code path, the affected thread or process can fail, causing denial of service. This issue is not known to provide code execution or data disclosure by itself.

Why it matters to the business

The primary risk is service instability or outage when untrusted JSON is parsed by vulnerable Karate components. Systems that embed Karate in runtime services, API gateways, developer platforms, CI/CD automation, or test execution services exposed to untrusted input may experience failed jobs, degraded API availability, or application restarts. The issue has been public for a long time, is not listed in CISA KEV, and has no known mature public exploitation signal in the provided data, so urgency should be driven by whether vulnerable parsing is reachable from untrusted users or automation inputs.

How an attack unfolds

An attacker first identifies an endpoint, workflow, or automation service that accepts JSON and processes it using a vulnerable version of com.intuit.karate:karate-core or its transitive json-smart parser. The attacker submits a JSON document containing extremely deep nesting, such as many repeated arrays or objects. When the vulnerable parser attempts to deserialize the payload, recursive parsing consumes the JVM stack until a StackOverflowError occurs. Depending on how the application handles fatal parser errors, this can terminate the request handler, fail a worker, crash a job, or force the JVM/process supervisor to restart the service. Repeated requests can turn a single parser failure into sustained denial of service.

How to fix it

Upgrade com.intuit.karate:karate-core to version 1.4.0 or later. Where dependency management allows, also ensure the transitive net.minidev:json-smart dependency is resolved to a non-vulnerable version; do not rely on an older transitive version being pulled in by another library. Regenerate lockfiles and rebuild artifacts after upgrading. If immediate upgrade is not possible, reduce exposure by blocking or rejecting excessively nested JSON, enforcing request body size limits, setting parser nesting-depth limits where available, isolating Karate-based execution from public traffic, and applying rate limits to endpoints or job submission paths that parse untrusted JSON.

How to confirm the fix worked

Confirm remediation with software composition analysis, Maven dependency inspection, and runtime artifact review. `com.intuit.karate:karate-core` should resolve to 1.4.0 or later, and no vulnerable json-smart version should remain in the effective dependency tree or packaged artifact. For Maven projects, run `mvn dependency:tree` and inspect generated SBOMs, shaded JARs, container images, and dependency lockfiles. Functionally validate that endpoints or workflows accepting JSON reject excessive nesting with a controlled 4xx/error response and do not produce StackOverflowError, worker death, or JVM restart. Re-run SCA scans after build and deployment to ensure the vulnerable transitive dependency is not reintroduced.

Typical attack path

1. Find an application, API, CI/CD service, test execution service, or automation workflow that accepts JSON from an untrusted or semi-trusted source.
2. Confirm or infer that JSON parsing is performed through a vulnerable Karate/json-smart dependency path.
3. Send a malicious JSON payload with excessive object or array nesting.
4. Trigger stack exhaustion during parsing, producing Java StackOverflowError or equivalent request/job failure.
5. Repeat the payload to cause recurring worker failures, degraded throughput, job failures, or service unavailability.

How to detect it

Historical exploitation is most likely to appear as denial-of-service symptoms rather than a durable host compromise. Review application logs, API gateway logs, CI/CD job logs, container logs, JVM crash/restart records, and APM traces for spikes in parser failures, `java.lang.StackOverflowError`, unexplained worker exits, repeated 5xx responses, or failed automation jobs after receiving unusually large or deeply nested JSON payloads. Correlate errors involving `net.minidev.json`, `json-smart`, or `com.intuit.karate` with request metadata such as source IP, route, user agent, content length, and request frequency. Look for repeated POST/PUT/PATCH requests with JSON bodies containing long runs of nested `[` or `{` characters. Because this flaw does not normally create files, persistence, accounts, or command execution artifacts, absence of host-level IOCs does not rule out attempted exploitation; focus on application-layer errors and traffic patterns.

• java.lang.StackOverflowError
• net.minidev.json.parser.JSONParser
• net.minidev.json.reader.JsonReader
• net.minidev.json.JSONValue
• com.intuit.karate
• com.intuit.karate:karate-core
• karate-core-1.3
• karate-core-1.2
• karate-core-1.1
• karate-core-1.0
• json-smart-2.4.8.jar
• json-smart-2.4.7.jar
• json-smart-2.4.6.jar
• json-smart-2.4.5.jar
• json-smart-2.4.4.jar
• json-smart-2.4.3.jar
• json-smart-2.4.2.jar
• json-smart-2.4.1.jar
• json-smart-2.4.0.jar
• [[[[[[[[[[[[[[[[[[[[
• {{{{{{{{{{{{{{{{{{{{

What your security team should do

• Inventory all applications, CI/CD jobs, automation services, and developer platforms using `com.intuit.karate:karate-core`.
• Prioritize upgrades where Karate or json-smart processes JSON supplied by external users, partners, build contributors, pull requests, webhooks, or other untrusted sources.
• Upgrade `com.intuit.karate:karate-core` to 1.4.0 or later and verify the effective json-smart dependency is no longer vulnerable.
• Add JSON body size, nesting-depth, timeout, and rate-limit controls around reachable parsing paths as defense in depth.
• Search logs for Java `StackOverflowError` events involving `net.minidev.json` or `com.intuit.karate`, especially correlated with large or deeply nested JSON requests.
• Add regression tests that submit deeply nested JSON and verify graceful rejection rather than process or worker failure.
• Monitor dependency management files and SBOMs to prevent older Karate or json-smart versions from being reintroduced.