Skip to content

Conversation

scyt01
Copy link

@scyt01 scyt01 commented Jul 17, 2025

Purpose of this pull request

This PR addresses a potential vulnerability in the read() function in chunjun-core/src/main/java/com/dtstack/chunjun/util/GsonUtil.java sourced from DTStack/chunjun that could lead to potential Denial of Service (DoS) risk and stack overflow due to recursive approach to handle JSON parsing. This issue, was originally reported and resolved in the repository via this commit google/gson@2d01d6a.

CVSS Rating: 7.5 (High)

Impact

  • Unbounded Recursion leading to Denial of Service (DoS) and Stack Overflow

Fix

  • Use an iterative approach to handle JSON parsing, making it more robust for deeply nested structures and less prone to stack overflow

References
google/gson@2d01d6a
https://nvd.nist.gov/vuln/detail/cve-2022-25647
https://nvd.nist.gov/vuln/detail/cve-2021-39144

@github-actions github-actions bot added the CORE label Jul 17, 2025
@aerbeisimeifannao
Copy link

aerbeisimeifannao commented Jul 17, 2025 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants