---
cve: "CVE-2023-4043"
severity: "MEDIUM"
cvss: 5.9
epss: "0.8%"
vendor: "Eclipse Foundation"
kev: false
exploited: false
published: "2023-11-03 09:15:13"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-23T16:31:10+02:00"
---

# CVE-2023-4043

> 5.9 MEDIUM · 🧪 PoC

## Beschreibung

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect.


To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Keine | good |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- 63b1d7393c539921853db1ddc0d92882c5931ae1 (Commit)
- 675484c73328fb5c559ee15ff496f6618c007d9e (Commit)

## Referenzen

- <https://github.com/eclipse-ee4j/parsson/pull/100>
- <https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/13>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2023-4043) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_