CVE-2023-5072: Stleary Json-java DOS Vulnerability

CVE-2023-5072 Overview

CVE-2023-5072 is a Denial of Service vulnerability affecting JSON-Java (org.json) versions up to and including 20230618. A bug in the JSON parser means that an input string of modest size can lead to indefinite amounts of memory being used, potentially causing application crashes or system unavailability. This vulnerability falls under CWE-770 (Allocation of Resources Without Limits or Throttling), highlighting improper resource management in the parsing logic.

Critical Impact
Attackers can exploit this vulnerability remotely without authentication to cause memory exhaustion and denial of service conditions in applications using vulnerable versions of the JSON-Java library.

Affected Products

stleary json-java versions up to and including 20230618
Applications and services using the vulnerable JSON-Java library as a dependency
Enterprise systems incorporating JSON-Java for JSON parsing operations

Discovery Timeline

2023-10-12 - CVE-2023-5072 published to NVD
2025-09-19 - Last updated in NVD database

Technical Details for CVE-2023-5072

Vulnerability Analysis

The vulnerability exists in the JSON-Java parser's handling of certain input strings. When processing specially crafted JSON input, the parser fails to properly limit memory allocation, allowing relatively small input strings to trigger disproportionately large memory consumption. This resource exhaustion vulnerability can be exploited remotely over the network without requiring any authentication or user interaction.

The flaw represents an algorithmic complexity attack where the parser's behavior becomes pathological when encountering specific input patterns. Rather than linear or predictable memory growth, the parser allocates memory in an uncontrolled manner, quickly exhausting available heap space.

Root Cause

The root cause is improper resource allocation handling in the JSON parsing logic. The parser lacks adequate bounds checking and memory allocation limits when processing certain input structures. This falls under CWE-770 (Allocation of Resources Without Limits or Throttling), where the application allocates resources without imposing reasonable constraints on the size or number of resources allocated.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can send a maliciously crafted JSON payload to any endpoint that uses the vulnerable JSON-Java library for parsing. The modest-sized input triggers the parser bug, causing excessive memory allocation that can lead to:

Application heap exhaustion and OutOfMemoryError exceptions
Service degradation or complete unavailability
Cascading failures in dependent services
Potential system-wide resource exhaustion in containerized environments

The vulnerability is particularly dangerous because the attack payload can be relatively small while causing disproportionate memory consumption, making it difficult to detect through simple size-based filtering.

Detection Methods for CVE-2023-5072

Indicators of Compromise

Sudden memory consumption spikes in applications using JSON-Java for parsing operations
OutOfMemoryError exceptions in application logs correlating with JSON parsing activities
Unusual garbage collection activity or prolonged GC pauses in JVM-based applications
Service unavailability or degraded response times following receipt of JSON payloads

Detection Strategies

Implement Software Composition Analysis (SCA) to identify applications using vulnerable JSON-Java versions
Monitor JVM heap usage and memory allocation patterns for anomalies during JSON processing
Deploy application performance monitoring (APM) to track memory consumption spikes
Review dependency manifests (pom.xml, build.gradle) for json-java versions at or below 20230618

Monitoring Recommendations

Configure alerting for rapid memory growth exceeding baseline thresholds in JSON-processing services
Implement request logging with payload size tracking to correlate with memory anomalies
Enable JVM memory monitoring with alerts for heap usage approaching configured limits
Monitor application health endpoints for availability degradation patterns

How to Mitigate CVE-2023-5072

Immediate Actions Required

Upgrade JSON-Java library to a version newer than 20230618 that contains the fix
Conduct a dependency audit to identify all applications using vulnerable JSON-Java versions
Implement input size limits at the application or API gateway level as a defense-in-depth measure
Review and update transitive dependencies that may include vulnerable JSON-Java versions

Patch Information

The vulnerability affects JSON-Java versions up to and including 20230618. Organizations should upgrade to a patched version of the library. Additional details are available in the GitHub JSON-java Issue #758 and GitHub JSON-java Issue #771. NetApp has also published guidance in their Security Advisory NTAP-20240621-0007.

Workarounds

Implement strict input size validation before passing data to the JSON parser
Deploy rate limiting on endpoints that accept JSON input to reduce attack surface
Configure JVM memory limits and container resource constraints to contain blast radius
Consider using alternative JSON parsing libraries as a temporary measure while planning upgrades

bash

# Configuration example - Maven dependency update
# Update pom.xml to use patched version
# Replace version 20230618 or earlier with latest patched version
# Example: <version>20231013</version> or later

# Verify current JSON-java version in your project
mvn dependency:tree | grep json