# cn.hutool:hutool-json (Maven) vulnerabilities

6 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/cn.hutool/hutool-json

## Advisories (6)

### [CVE-2023-42278](https://cve.now/CVE-2023-42278): hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().

- Severity: Unrated
- Published: Sep 8, 2023
- Affected: fixed in 5.8.22.

### [CVE-2023-42277](https://cve.now/CVE-2023-42277): hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.

- Severity: Unrated
- Published: Sep 8, 2023
- Affected: through 5.8.21.

### [CVE-2023-42276](https://cve.now/CVE-2023-42276): hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.

- Severity: Unrated
- Published: Sep 8, 2023
- Affected: through 5.8.21.

### [CVE-2022-45690](https://cve.now/CVE-2022-45690): A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a…

- Severity: High 7.5
- Published: Dec 13, 2022
- Affected: fixed in 5.8.11.

### [CVE-2022-45689](https://cve.now/CVE-2022-45689): hutool-json v5.8.10 was discovered to contain an out of memory error.

- Severity: High 7.5
- Published: Dec 13, 2022
- Affected: through 5.8.10.

### [CVE-2022-45688](https://cve.now/CVE-2022-45688): A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted…

- Severity: High 7.5
- Published: Dec 13, 2022
- Affected: fixed in 5.8.25.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/cn.hutool:hutool-json
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.