CVE catalog

CVE-2023-5072

jenkins-json: CVE-2023-5072

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Oct 12, 2023, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.74% · Oct 27, 2026

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	jenkins-json	sid	`2.4-jenkins-8+dfsg-1`	vulnerable
Debian	jenkins-json	forky	`2.4-jenkins-8+dfsg-1`	vulnerable
Debian	jenkins-json	trixie	`2.4-jenkins-8+dfsg-1`	vulnerable
Debian	jenkins-json	bookworm	`2.4-jenkins-3-7`	vulnerable
Debian	libjson-java	sid	`3.2.0+dfsg-3`	fixed
Debian	libjson-java	forky	`3.2.0+dfsg-2`	fixed
Debian	libjson-java	trixie	`3.1.0+dfsg-2`	fixed
Debian	libjson-java	bookworm	`2.4-3.1`	vulnerable
Debian	libjettison-java	sid	`1.5.4-1`	vulnerable
Debian	libjettison-java	forky	`1.5.4-1`	vulnerable
Debian	libjettison-java	trixie	`1.5.4-1`	vulnerable
Debian	libjettison-java	bookworm	`1.5.3-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	jenkins-json	source	sid	`(unfixed)`	not yet assigned	Not reported	[1053883]
Debian	jenkins-json	source	forky	`(unfixed)`	not yet assigned	Not reported	[1053883]
Debian	jenkins-json	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1053883]
Debian	jenkins-json	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1053883]
Debian	libjson-java	source	sid	`3.1.0+dfsg-1`	not yet assigned	Not reported	[1053882]
Debian	libjson-java	source	forky	`3.1.0+dfsg-1`	not yet assigned	Not reported	[1053882]
Debian	libjson-java	source	trixie	`3.1.0+dfsg-1`	not yet assigned	Not reported	[1053882]
Debian	libjson-java	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1053882]
Debian	libjettison-java	source	sid	`(unfixed)`	not yet assigned	Not reported	[1053884]
Debian	libjettison-java	source	forky	`(unfixed)`	not yet assigned	Not reported	[1053884]
Debian	libjettison-java	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1053884]
Debian	libjettison-java	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1053884]

[Debian bug #1053883][Debian bug #1053882][Debian bug #1053884]

Notes

[trixie] jenkins-json: Minor issue, revisit when fixed upstream [bookworm] jenkins-json: Minor issue, revisit when fixed upstream [bookworm] libjson-java: Minor issue, revisit when fixed upstream [trixie] libjettison-java: Minor issue, revisit when fixed upstream [bookworm] libjettison-java: Minor issue, revisit when fixed upstream

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libjenkins-json-java]Affected
Source package: [jenkins-json]
Details (2)
- 2.4-jenkins-3-7 · all · bookworm
  Affected
  dsa · jenkins-json · debian · bookworm; dsa · jenkins-json · debian · 12
- 2.4-jenkins-3-7 · all · bookworm
  Affected
  dsa · jenkins-json · debian · bookworm; dsa · jenkins-json · debian · 12
[libjettison-java]Affected
Details (2)
- 1.5.3-1 · all · bookworm
  Affected
  dsa · libjettison-java · debian · bookworm; dsa · libjettison-java · debian · 12
- 1.5.3-1 · all · bookworm
  Affected
  dsa · libjettison-java · debian · bookworm; dsa · libjettison-java · debian · 12
[libjson-java]Affected
Details (2)
- 2.4-3.1 · all · bookworm
  Affected
  dsa · libjson-java · debian · bookworm; dsa · libjson-java · debian · 12
- 2.4-3.1 · all · bookworm
  Affected
  dsa · libjson-java · debian · bookworm; dsa · libjson-java · debian · 12

[Debian 13 (Trixie)]

[libjenkins-json-java]Affected
Source package: [jenkins-json]
Details (2)
- 2.4-jenkins-8+dfsg-1 · all · trixie
  Affected
  dsa · jenkins-json · debian · 13
- 2.4-jenkins-8+dfsg-1 · all · trixie
  Affected
  dsa · jenkins-json · debian · 13
[libjettison-java]Affected
Details (2)
- 1.5.4-1 · all · trixie
  Affected
  dsa · libjettison-java · debian · 13
- 1.5.4-1 · all · trixie
  Affected
  dsa · libjettison-java · debian · 13
[libjson-java]Fixed
Details (2)
- 3.1.0+dfsg-2 · all · trixie
  Fixed · Fixed: 3.1.0+dfsg-1
  dsa · libjson-java · debian · 13
- 3.1.0+dfsg-2 · all · trixie
  Fixed · Fixed: 3.1.0+dfsg-1
  dsa · libjson-java · debian · 13

Observed: Oct 28, 2026, 5:43:41 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]