PT-2025-17395 · Mjson · Mjson

Published 2025-04-19 · Updated 2025-04-20 · CVE-2023-30421

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions mjson version 1.2.7

Description The issue arises in the mystrtod function of mjson, which requires an excessive number of iterations when processing specific digit strings, such as 8891110122900e913013935755114. This can lead to potential performance issues or other problems.

Recommendations For mjson version 1.2.7, consider applying configuration changes or workarounds to minimize the risk of exploitation, such as restricting the input of certain digit strings. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2023-30421

Affected Products

Mjson

References · 9

• https://osv.dev/vulnerability/CVE-2023-30421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30421 · Security Note
• https://github.com/cesanta/mjson/releases · Note
• https://t.me/cvedetector/23397 · Telegram Post
• https://twitter.com/CVETracker/status/1914046600306884896 · Twitter Post
• https://twitter.com/CVEnew/status/1913823711758635375 · Twitter Post
• https://t.me/cvetracker/22009 · Telegram Post
• https://t.me/cvenotify/119053 · Telegram Post
• https://github.com/boofish/json_bugs/blob/main/mjson · Note