Skip to content

Update dependency net.minidev:json-smart to v2.4.9 [SECURITY]#16

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/json-smart.version
Open

Update dependency net.minidev:json-smart to v2.4.9 [SECURITY]#16
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/json-smart.version

Conversation

@renovate

@renovate renovate Bot commented Mar 1, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
net.minidev:json-smart (source) 2.4.8 → 2.4.9 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

json-smart Uncontrolled Recursion vulnerability

CVE-2023-1370 / GHSA-493p-pfq6-5258

More information

Details

Impact

Affected versions of net.minidev:json-smart are vulnerable to Denial of Service (DoS) due to a StackOverflowError when parsing a deeply nested JSON array or object.

When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the 3PP does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause stack exhaustion (stack overflow) and crash the software.

Patches

This vulnerability was fixed in json-smart version 2.4.9, but the maintainer recommends upgrading to 2.4.10, due to a remaining bug.

Workarounds

N/A

References

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

netplex/json-smart-v2 (net.minidev:json-smart)

v2.4.9: V 2.4.9

Compare Source

V 2.4.9 (2023-03-07)
  • Add depth limit of 400 when parsing JSON.

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.4.8...2.4.9

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner March 1, 2026 06:52
@renovate
renovate Bot requested review from Verox-, awhodgson256 and kudu-moj and removed request for a team March 1, 2026 06:52
@cpp-github-management

cpp-github-management Bot commented Mar 1, 2026

Copy link
Copy Markdown

Passed

@renovate
renovate Bot force-pushed the renovate/json-smart.version branch 2 times, most recently from 49ade9a to 72b07f0 Compare March 18, 2026 14:38
@cpp-github-management

cpp-github-management Bot commented Mar 18, 2026

Copy link
Copy Markdown

Passed

@renovate renovate Bot changed the title Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate
renovate Bot deleted the renovate/json-smart.version branch March 27, 2026 11:04
@renovate renovate Bot changed the title Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] - autoclosed Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] Mar 31, 2026
@renovate renovate Bot reopened this Mar 31, 2026
@renovate
renovate Bot force-pushed the renovate/json-smart.version branch 2 times, most recently from 72b07f0 to cbe0a47 Compare March 31, 2026 18:50
@cpp-github-management

cpp-github-management Bot commented Mar 31, 2026

Copy link
Copy Markdown

Passed

@renovate
renovate Bot force-pushed the renovate/json-smart.version branch 2 times, most recently from a48da8a to 6c78df2 Compare April 3, 2026 08:44
@cpp-github-management

cpp-github-management Bot commented Apr 3, 2026

Copy link
Copy Markdown

Passed

@renovate
renovate Bot force-pushed the renovate/json-smart.version branch 2 times, most recently from a01197d to 35283bd Compare April 9, 2026 14:03
@cpp-github-management

cpp-github-management Bot commented Apr 9, 2026

Copy link
Copy Markdown

Passed

@renovate
renovate Bot force-pushed the renovate/json-smart.version branch 3 times, most recently from 1332923 to e4320fb Compare April 10, 2026 13:28
@cpp-github-management

cpp-github-management Bot commented Apr 10, 2026

Copy link
Copy Markdown

Passed

@renovate renovate Bot changed the title Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] - autoclosed Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] Apr 28, 2026
@renovate renovate Bot reopened this Apr 28, 2026
@renovate
renovate Bot force-pushed the renovate/json-smart.version branch 2 times, most recently from e4320fb to bf054c1 Compare April 28, 2026 11:44
@cpp-github-management

cpp-github-management Bot commented Apr 28, 2026

Copy link
Copy Markdown

Passed

@renovate
renovate Bot force-pushed the renovate/json-smart.version branch from bf054c1 to 943f06d Compare May 2, 2026 09:15
@cpp-github-management

cpp-github-management Bot commented May 2, 2026

Copy link
Copy Markdown

Passed

@renovate
renovate Bot force-pushed the renovate/json-smart.version branch from 943f06d to 687d394 Compare May 2, 2026 10:08
@renovate
renovate Bot force-pushed the renovate/json-smart.version branch 2 times, most recently from f1ed4e9 to 8498ed1 Compare May 15, 2026 14:38
@cpp-github-management

cpp-github-management Bot commented May 15, 2026

Copy link
Copy Markdown

Passed

@renovate
renovate Bot force-pushed the renovate/json-smart.version branch 2 times, most recently from 66aea18 to 2b4cf00 Compare May 29, 2026 10:22
@cpp-github-management

cpp-github-management Bot commented May 29, 2026

Copy link
Copy Markdown

Passed

@renovate renovate Bot changed the title Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] Update json-smart.version to v2.4.9 [SECURITY] Jun 3, 2026
@renovate renovate Bot changed the title Update json-smart.version to v2.4.9 [SECURITY] Update json-smart.version [SECURITY] Jun 22, 2026
@renovate renovate Bot changed the title Update json-smart.version [SECURITY] Update dependency net.minidev:json-smart to v2.4.9 [SECURITY] Jun 25, 2026
@renovate
renovate Bot force-pushed the renovate/json-smart.version branch from 2b4cf00 to fcedf62 Compare July 2, 2026 15:26
@cpp-github-management

cpp-github-management Bot commented Jul 2, 2026

Copy link
Copy Markdown

Passed

@renovate
renovate Bot force-pushed the renovate/json-smart.version branch from fcedf62 to 9e37779 Compare July 2, 2026 17:26
@cpp-github-management

cpp-github-management Bot commented Jul 2, 2026

Copy link
Copy Markdown

Passed

@renovate
renovate Bot force-pushed the renovate/json-smart.version branch from 9e37779 to 704cff0 Compare July 15, 2026 13:20
@cpp-github-management

cpp-github-management Bot commented Jul 15, 2026

Copy link
Copy Markdown

Passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Verox- Verox- Awaiting requested review from Verox- Verox- is a code owner automatically assigned from hmcts/cpp-development
@awhodgson256 awhodgson256 Awaiting requested review from awhodgson256 awhodgson256 is a code owner automatically assigned from hmcts/cpp-development
@kudu-moj kudu-moj Awaiting requested review from kudu-moj kudu-moj is a code owner automatically assigned from hmcts/cpp-development

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants