-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.spray:spray-json | maven | < 1.3.5 | 1.3.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from recursive descent parsing in Spray JSON's core parser. Both object and array parsing functions (parseObject/parseArray) recursively call themselves to handle nested structures. In vulnerable versions (<1.3.5), these functions lacked depth tracking, allowing attackers to craft JSON with excessive nesting that would cause StackOverflowErrors. The fix (in 1.3.5) introduced a depth counter and limit, confirming these functions were the vulnerable points. The confidence is high as recursive structure parsing is fundamental to JSON processing and the CVE explicitly calls out stack-based resource exhaustion.
Ongoing coverage of React2Shell