Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

未经控制的递归

netplex json-smart 安全漏洞

netplex json-smart是开源的一个JSON Java解析器。 netplex json-smart存在安全漏洞，该漏洞源于代码对到达 JSON 输入中的数组或对象的嵌套没有任何限制，嵌套数组和对象的解析是递归完成的，导致堆栈耗尽（堆栈溢出）并导致软件崩溃。

N/A

N/A