5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3588

CVE-2025-3588: jsonschema2pojo has Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function apply of the file org/jsonschema2pojo/rules/SchemaRule.java of the component JSON File Handler. The manipulation leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3588

CVE-2025-3588:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jsonschema2pojo:jsonschema2pojo-core	maven	<= 1.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a StackOverflowError caused by uncontrolled recursion in the org.jsonschema2pojo.rules.SchemaRule.apply method when processing a JSON schema with a self-referential \"$ref\": \"#\". This was identified by analyzing the GitHub issue #1672 for joelittlejohn/jsonschema2pojo, which includes a description of the error, a stack trace, and relevant code snippets from SchemaRule.java.

org.jsonschema2pojo.rules.SchemaRule.apply: This function is the primary location of the vulnerability. It recursively calls itself. The issue arises when a \"$ref\": \"#\" is encountered. The function nameFromRef is called, and for \"#\", it returns null. The apply function then calls ruleFactory.getSchemaStore().create() and updates schemaNode with schema.getContent(). Crucially, the termination condition schema.isGenerated() is not met for this scenario. As a result, apply calls itself again with parameters that do not lead to a resolution, causing infinite recursion and eventually a StackOverflowError.
org.jsonschema2pojo.rules.SchemaRule.nameFromRef: This helper function is directly involved in creating the vulnerable condition. Its specific behavior of returning null when the input ref is \"#\" is a key step. This null return value influences how the apply method constructs its recursive call, preventing the resolution of the reference in a way that would terminate the recursion.

The stack trace provided in the issue (at org.jsonschema2pojo.rules.SchemaRule.apply(SchemaRule.java:69), at org.jsonschema2pojo.rules.SchemaRule.apply(SchemaRule.java:76)) confirms the recursive calls to apply. The code snippets and analysis within the issue clearly demonstrate the logical flow leading to the stack overflow. No patch information was available, so the analysis relies on the detailed issue description and the provided code excerpts.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.