CVE-2024-57699: Netplex Json-smart Uncontrolled Recursion vulnerability

The vulnerability is an uncontrolled recursion (stack exhaustion) when parsing a specially crafted JSON with excessive nesting. The fix involves adding the LIMIT_JSON_DEPTH flag to predefined parser modes (MODE_RFC4627, MODE_JSON_SIMPLE, MODE_STRICTEST) in JSONParser.java. This implies that before the patch, these modes were vulnerable. The JSONParser constructor (<init>) is used to create a parser instance, potentially with one of these vulnerable modes. The parse method of this JSONParser instance is then used to process the JSON input, and it's this method (and the internal recursive methods it calls for parsing objects/arrays) that would exhaust the stack if no depth limit is enforced. The added test file TestCVE202457699.java explicitly shows the instantiation of JSONParser with these modes and then calling the parse method with a malicious string designed to cause deep recursion.