CVE-2023-7272 is a denial of service flaw in Eclipse Parsson, a Java JSON processing library. A document with deeply nested objects can cause a stack overflow exception. It scores 8.6 (High). Versions before 1.0.4 and 1.1.3 are affected, so upgrade to 1.0.4 or 1.1.3, or later.
What's affected
Affected: Eclipse Parsson before 1.0.4 and before 1.1.3. In practice, the 1.0 line is fixed at 1.0.4 and the 1.1 line is fixed at 1.1.3. The Eclipse vulnerability report was filed against Parsson 1.1.2, and its affected versions field is not filled in, so the record is the source for the ranges.
Parsson parses, generates, transforms and queries JSON documents. It is a Maven library, and it may reach your application as a transitive dependency of a Jakarta JSON Processing consumer, which makes it easy to miss.
The vector is network reachable, no privileges, no user interaction, with a changed scope and the whole impact on availability. KEV is false.
Source note: the record classifies the weakness as CWE-787, out-of-bounds write. The behavior it describes is a Java stack overflow exception from deep recursion, which is not a memory write in the C sense. Trust the description over the label.
How to check if you're exposed
Find Parsson in your dependency tree.
mvn dependency:tree -Dincludes=org.eclipse.parsson
# or with Gradle
gradle dependencies | grep -i parsson
Any result below 1.0.4 on the 1.0 line, or below 1.1.3 on the 1.1 line, needs an update. Also scan container images and application servers, since Parsson can be bundled inside them where your build files do not show it. The free in-browser dependency scan at gold.safeguard.sh/scan can read a dependency manifest or SBOM for you.
What to do now
- Upgrade Parsson to 1.0.4 or 1.1.3, or a later release on your line.
- Check the application servers and runtimes you deploy, and update the ones that bundle Parsson.
- Limit the size and nesting depth of JSON you accept at the edge, for example with a reverse proxy request size limit, as defense in depth.
- Make sure a crash in one request thread cannot take the whole service down, with timeouts and restarts.
- Use reachability analysis to learn whether your code actually parses untrusted JSON through Parsson, so you can rank the work.
Why it matters
A recursive parser calls itself for each level of nesting. Feed it a document with a very large number of levels and the call stack runs out, throwing a StackOverflowError. If the application does not handle that cleanly, the request fails, and a stream of such requests can keep a service down.
The fix is to cap nesting depth or to avoid deep recursion. Parsing untrusted input without a depth limit is a classic availability risk.
Libraries like this are exactly where reachability matters. Many applications include Parsson but only parse JSON they produced themselves. Others parse request bodies from the internet. Knowing which one you are decides how fast to move.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is code execution possible with CVE-2023-7272?
The record describes a denial of service through a stack overflow exception, not code execution.
Do I use Parsson if I never added it?
Possibly. It can arrive as a transitive dependency or be bundled in a server. Check the dependency tree.
Sources
Last reviewed: 19 October 2026.
