{"id":"GHSA-5wfc-hjrc-gq87","aliases":["CVE-2023-34620","GO-2026-5157"],"title":"hjson stack exhaustion vulnerability","description":"An issue was discovered hjson through 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.","severity":"high","score":7.5,"published":"2023-06-14T15:30:38.000Z","modified":"2026-09-10T03:50:02.120Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Maven","name":"org.hjson:hjson","ranges":[{"events":[{"introduced":"0"},{"fixed":"3.0.1"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","1.0.1","1.1.0","1.1.2","1.1.3","1.1.4","2.0.0","2.0.1","2.1.0","2.1.1","3.0.0"],"fixed":["3.0.1"]},{"ecosystem":"Packagist","name":"laktak/hjson","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.3.0"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","v1.0.1","v1.0.2","v2.0.0","v2.0.1","v2.0.2","v2.1.0","v2.2.0","v2.2.1","v2.2.2"],"fixed":["2.3.0"]},{"ecosystem":"Go","name":"github.com/hjson/hjson-go/v4","ranges":[{"events":[{"introduced":"0"},{"fixed":"4.5.0"}],"type":"SEMVER"}],"versions":[],"fixed":["4.5.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2023-34620","https://github.com/hjson/hjson-java/issues/24","https://github.com/hjson/hjson-cpp/pull/54","https://github.com/hjson/hjson-go/pull/67","https://github.com/hjson/hjson-php/pull/45","https://github.com/hjson/hjson-go/commit/326599cebc6ef759892f473bf1439b98466a99fa","https://github.com/hjson/hjson-php/commit/2d1b8b4b158a8d841f3a228f267c7cd84fe5a4fa"],"sources":[{"name":"OSV","id":"GHSA-5wfc-hjrc-gq87","modified":"2026-09-10T03:50:02.120371256Z","url":"https://osv.dev/vulnerability/GHSA-5wfc-hjrc-gq87"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}]}