medium5.5
CVE-2023-33546
janino vulnerable to denial of service due to stack overflow
Impact
janino 3.1.9 and earlier is subject to denial of service (DOS) attacks when using the expression `evaluator.guess` parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.codehaus.janino:janino-parent | <= 3.1.9 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Janino Project | Janino | through 3.1.9 |