Stack-Based Buffer Overflow in json-patch Java Library

Executive Summary

This vulnerability is a stack-based buffer overflow in the java-json-tools json-patch library up to version 1.13. It occurs in the JsonMergePatchDeserializer.java file during JSON merge patch processing. The flaw allows attackers to cause a stack overflow by sending deeply nested JSON objects, leading to a denial-of-service condition. The issue stems from uncontrolled recursion without depth limits in the deserialization process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for stack overflow errors in applications using json-patch 1.13. Check logs for StackOverflowError exceptions during JSON Merge Patch operations. Use network traffic analysis tools to identify unusually large or deeply nested JSON payloads (over 2000 levels) sent to endpoints using JsonMergePatch.fromJson().

Commands: 1) grep -r 'StackOverflowError' /var/log/ 2) tcpdump -i any -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -a '{' 3) Use application performance monitoring tools to track thread pool exhaustion events.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial-of-service by crashing applications using the affected library. Attackers can send a single HTTP request with a ~40KB payload containing deeply nested JSON to trigger a stack overflow. This may exhaust the application's thread pool and disrupt services. The attack requires no authentication and can be performed remotely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt services handling sensitive data. A stack overflow could crash applications processing JSON Merge Patch requests, potentially leading to service unavailability for systems managing personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of json-patch that includes recursion depth limits in the deserialize() method. If upgrading is not possible, implement application-level safeguards by adding input validation to reject JSON payloads exceeding a safe nesting depth (e.g., 1000 levels). Temporarily disable endpoints using JsonMergePatch if they are not critical.

Apply network-level protections like WAF rules to block excessively large or deeply nested JSON requests. Monitor for exploitation attempts and restrict access to affected endpoints until mitigation is complete.

Useful 0 Not Useful 0