Skip to content

fix(sec): fix JSON parsing stack overflow vulnerabilities #1939

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

scyt01
Copy link

@scyt01 scyt01 commented Jul 17, 2025

Purpose of this pull request

This PR addresses a potential vulnerability in the read() function in chunjun-core/src/main/java/com/dtstack/chunjun/util/GsonUtil.java sourced from DTStack/chunjun that could lead to potential Denial of Service (DoS) risk and stack overflow due to recursive approach to handle JSON parsing. This issue, was originally reported and resolved in the repository via this commit google/gson@2d01d6a.

CVSS Rating: 7.5 (High)

Impact

  • Unbounded Recursion leading to Denial of Service (DoS) and Stack Overflow

Fix

  • Use an iterative approach to handle JSON parsing, making it more robust for deeply nested structures and less prone to stack overflow

References
google/gson@2d01d6a
https://nvd.nist.gov/vuln/detail/cve-2022-25647
https://nvd.nist.gov/vuln/detail/cve-2021-39144

@github-actions github-actions bot added the CORE label Jul 17, 2025
@aerbeisimeifannao
Copy link

aerbeisimeifannao commented Jul 17, 2025 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants