{"api_version":"1","generated_at":"2026-04-22T23:31:35+00:00","cve":"CVE-2022-40149","urls":{"html":"https://cve.report/CVE-2022-40149","api":"https://cve.report/api/cve/CVE-2022-40149.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-40149","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-40149"},"summary":{"title":"CVE-2022-40149","description":"Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.","state":"PUBLIC","assigner":"security@google.com","published_at":"2022-09-16 10:15:00","updated_at":"2023-03-01 16:32:00"},"problem_types":["CWE-787"],"metrics":[],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538","name":"N/A","refsource":"CONFIRM","tags":[],"title":"46538 - \n \n \n oss-fuzz -\n \n \n OSS-Fuzz: Fuzzing the planet - \n \n Monorail","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.debian.org/security/2023/dsa-5312","name":"DSA-5312","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5312-1 libjettison-java","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/jettison-json/jettison/issues/45","name":"N/A","refsource":"CONFIRM","tags":[],"title":"New OSS-Fuzz Findings in Jettison · Issue #45 · jettison-json/jettison · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html","name":"[debian-lts-announce] 20221110 [SECURITY] [DLA 3184-1] libjettison-java security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3184-1] libjettison-java security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40149","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40149","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"40149","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"40149","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"40149","vulnerable":"1","versionEndIncluding":"1.4.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jettison_project","cpe5":"jettison","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-40149","qid":"181202","title":"Debian Security Update for libjettison-java (DLA 3184-1)"},{"cve":"CVE-2022-40149","qid":"181465","title":"Debian Security Update for libjettison-java (DSA 5312-1)"},{"cve":"CVE-2022-40149","qid":"183663","title":"Debian Security Update for libjettison-java (CVE-2022-40149)"},{"cve":"CVE-2022-40149","qid":"199430","title":"Ubuntu Security Notification for Jettison Vulnerabilities (USN-6177-1)"},{"cve":"CVE-2022-40149","qid":"241153","title":"Red Hat Update for JBoss Enterprise Application Platform 7.4.9 (RHSA-2023:0554)"},{"cve":"CVE-2022-40149","qid":"241154","title":"Red Hat Update for JBoss Enterprise Application Platform 7.4.9 (RHSA-2023:0552)"},{"cve":"CVE-2022-40149","qid":"241155","title":"Red Hat Update for JBoss Enterprise Application Platform 7.4.9 (RHSA-2023:0553)"},{"cve":"CVE-2022-40149","qid":"356772","title":"Amazon Linux Security Advisory for jettison : ALAS2-2023-2363"},{"cve":"CVE-2022-40149","qid":"377909","title":"Oracle PeopleSoft Enterprise PeopleTools Product Multiple Vulnerabilities (CPUJAN2023)"},{"cve":"CVE-2022-40149","qid":"731305","title":"Atlassian Jira Software Data Center and Server Denial of Service (DoS) Vulnerability (JSWSERVER-25795)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@google.com","ID":"CVE-2022-40149","STATE":"PUBLIC","TITLE":"Stack Buffer Overflow in Jettison"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Jettison","version":{"version_data":[{"version_affected":"<=","version_value":"1.4.0"}]}}]},"vendor_name":"Jettison"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-121 Stack-based Buffer Overflow"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538","name":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538"},{"refsource":"MISC","url":"https://github.com/jettison-json/jettison/issues/45","name":"https://github.com/jettison-json/jettison/issues/45"},{"refsource":"MLIST","name":"[debian-lts-announce] 20221110 [SECURITY] [DLA 3184-1] libjettison-java security update","url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html"},{"refsource":"DEBIAN","name":"DSA-5312","url":"https://www.debian.org/security/2023/dsa-5312"}]},"source":{"discovery":"INTERNAL"}},"nvd":{"publishedDate":"2022-09-16 10:15:00","lastModifiedDate":"2023-03-01 16:32:00","problem_types":["CWE-787"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:jettison_project:jettison:*:*:*:*:*:*:*:*","versionEndIncluding":"1.4.0","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}