Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2022-40155

CVE-2022-40155:
Denial of Service via stack overflow

N/A

CVSS Score

Basic Information

CVE ID
CVE-2022-40155
GHSA ID
GHSA-5hc5-c3m9-8vcj
EPSS Score
-
CWE
CWE-787
Published
9/17/2022
Updated
1/31/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS metrics data is empty
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.fasterxml.woodstox:woodstox-coremaven>= 6.0.0, < 6.4.06.4.0
com.fasterxml.woodstox:woodstox-coremaven< 5.4.05.4.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unlimited recursion in DTD parsing. The patch (PR #159) introduced a recursion depth limit in FullDTDReader, indicating this class's parse method was previously vulnerable. The CWE-787 classification appears incorrect; the actual issue was CWE-674 (Uncontrolled Recursion). The affected versions lacked depth checks during DTD processing, making the parse method susceptible to stack overflow via malicious DTDs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## Wit**r*wn T*is **visory **s ***n wit**r*wn ****us* it **s ***n *oun* to ** * *upli**t*. Pl**s* s** t** issu* [**r*](*ttps://*it*u*.*om/x-str**m/xstr**m/issu*s/***#issu**omm*nt-**********) *or mor* in*orm*tion. ## Ori*in*l **sp*ription T*os* us

Reasoning

T** vuln*r**ility st*ms *rom unlimit** r**ursion in *T* p*rsin*. T** p*t** (PR #***) intro*u*** * r**ursion **pt* limit in *ull*T*R****r, in*i**tin* t*is *l*ss's p*rs* m*t*o* w*s pr*viously vuln*r**l*. T** *W*-*** *l*ssi*i**tion *pp**rs in*orr**t; t*