CVE-2023-33008mediumCWE-502

CVE-2023-33008: medium-severity vulnerability in Apache Johnzon

Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale

Published · Updated

Follow this CVE+ Monitor Apache Johnzon+ Monitor org.apache.johnzon:johnzon-mapper

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 1.4%
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. This issue affects Apache Johnzon: through 1.2.20.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Apache Software Foundation · Apache Johnzon
Related CVEs — Apache Johnzon

In the same product, most dangerous first.

CVE-2026-71253CRITICALApache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSONEPSS 0.4%