PT-2025-5776 · Unknown+2 · Netplex Json-Smart+4

Published 2025-02-05 · Updated 2026-04-01 · CVE-2024-57699

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Netplex Json-smart versions 2.5.0 through 2.5.1 Confluence Data Center and Server versions prior to 8.5.22 Confluence Data Center and Server versions prior to 9.2.4 Confluence Data Center and Server versions prior to 9.4.1 Bamboo Data Center and Server versions prior to 9.6.11 Bamboo Data Center and Server versions prior to 10.2.3 Bitbucket Data Center and Server versions prior to 8.9.27 Bitbucket Data Center and Server versions prior to 8.19.18 Bitbucket Data Center and Server versions prior to 9.4.5 Bitbucket Data Center and Server versions prior to 9.5.2 Bitbucket Data Center and Server versions prior to 9.6.2

Description: A security issue was found in Netplex Json-smart when loading a specially crafted JSON input, containing a large number of '{', which could trigger a stack exhaustion and allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for a previous vulnerability. The vulnerability allows an unauthenticated attacker to expose assets in the environment susceptible to exploitation, with no impact to confidentiality, no impact to integrity, high impact to availability, and requires no user interaction.

Recommendations: For Netplex Json-smart versions 2.5.0 through 2.5.1, consider disabling the JSONParser or setting the LIMIT JSON DEPTH option to prevent exploitation until a patch is available. For Confluence Data Center and Server, upgrade to a release greater than or equal to 8.5.22, 9.2.4, or 9.4.1. For Bamboo Data Center and Server, upgrade to a release greater than or equal to 9.6.11 or 10.2.3. For Bitbucket Data Center and Server, upgrade to a release greater than or equal to 8.9.27, 8.19.18, 9.4.5, 9.5.2, or 9.6.2. As a temporary workaround, consider restricting access to the JSONParser or setting custom options to mitigate the risk of exploitation.

Exploit

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

BDU:2026-01707

CLEANSTART-2026-TZ04509

CVE-2024-57699

GHSA-PQ2G-WX69-C263

OESA-2025-1164

RHSA-2025:10092

RHSA-2025:10097

RHSA-2025:10098

RHSA-2025:10104

RHSA-2025:10118

RHSA-2025:10119

RHSA-2025:10120

Affected Products

Bamboo

Bitbucket

Confluence

Debian

Netplex Json-Smart

References · 37

• 🔥 https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699 · Exploit
• https://osv.dev/vulnerability/OESA-2025-1164 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-57699 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-57699 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57699 · Security Note
• https://nvd.nist.gov/vuln/detail/cve-2023-1370 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59250 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-TZ04509 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-57699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1002 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57699 · Security Note
• https://ubuntu.com/security/CVE-2024-57699 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-57699 · Security Note
• https://osv.dev/vulnerability/GHSA-pq2g-wx69-c263 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-57699 · Vendor Advisory