{"id":"CVE-2026-4735","summary":"A stack overflow and DoS vulnerability in DTStack/chunjun","details":"Deserialization of Untrusted Data vulnerability in DTStack chunjun (\u200echunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnerability is associated with program files GsonUtil.Java.\n\nThis issue affects chunjun: before 1.16.1.","modified":"2026-08-12T16:25:23.265956Z","published":"2026-03-24T03:08:18.156Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4735.json","cna_assigner":"GovTech CSG","cwe_ids":["CWE-502"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4735.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4735"},{"type":"FIX","url":"https://github.com/DTStack/chunjun/pull/1939"},{"type":"PACKAGE","url":"https://github.com/DTStack/chunjun"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dtstack/chunjun","events":[{"introduced":"0"},{"fixed":"cff5fbffb498a60e0fb700f77073deeebb7ed3e6"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.16.1"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v1.12.7","v1.12.8","v1.12.5","v1.12.4","v1.12.3","r1.8.1","r1.8.0","v1.5.2","r1.5.2","r1.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4735.json","vanir_signatures_modified":"2026-08-12T16:25:23Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6","target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncConverter.java","function":"KafkaSyncConverter"},"deprecated":false,"digest":{"function_hash":"279906687212391003223050923325117445468","length":352},"id":"CVE-2026-4735-13712ce1","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"14961469517989358436422224190899541383","length":151},"id":"CVE-2026-4735-2b8e9bfb","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6","target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncKeyConverter.java","function":"KafkaSyncKeyConverter"}},{"target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncKeyConverter.java","function":"KafkaSyncKeyConverter"},"deprecated":false,"digest":{"function_hash":"165298536957404862989778058946343504125","length":52},"id":"CVE-2026-4735-392dcb18","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6"},{"deprecated":false,"digest":{"line_hashes":["27472061896725043440778360417776024772","247069045381520611208605095891834476027","298195100281213533677464829243118271053","176801034395515347506893324939960013194","44126896738637099335260850491877858755","297378463328241894296155043587339169990","281046937688404527109161605516599767075","40298537806385345844602257512649948235","79219918838423812059708120517868504147","65147302998449949520680222882592322174","336757479202988604787560270897414188722","46595710293519128876697565867554982482","103865943392787861144461546601764417688","287220643454365684291923236833435013663"],"threshold":0.9},"id":"CVE-2026-4735-8a14a27b","signature_type":"Line","signature_version":"v1","source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6","target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncKeyConverter.java"}},{"deprecated":false,"digest":{"function_hash":"318255106755676667030630912824802511112","length":1485},"id":"CVE-2026-4735-963842d7","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6","target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/sink/KafkaSinkFactory.java","function":"createOutput"}},{"deprecated":false,"digest":{"length":1131,"function_hash":"41397982107967171119722267885701428859"},"id":"CVE-2026-4735-b3232cad","signature_type":"Function","signature_version":"v1","source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6","target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/source/KafkaSourceFactory.java","function":"createSource"}},{"source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6","target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncConverter.java"},"deprecated":false,"digest":{"line_hashes":["101717256150954230054909639610770333585","286628152737368014138819779411984933884","229133547977017232974810006928191050471","37544693163321652162476396347563597075","314394844917759658532232977844308496430","31195505722641946345247899788093766208","31210111341283022086561802029302372084","295243085941699209895953411764395492254","160843761853243261581803069490671800810","326084103185048218331640584574065347088","100643146002224403029696469702950558678","92175172678751775020752650032237996193","26065577305130728529038777292794258574","292762933396227637003357008216390050026"],"threshold":0.9},"id":"CVE-2026-4735-cae4af92","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["6158041935588308093385177773257176557","310862284039913157826440302377508860016","228676624695947347715534049197030072551","333554729478656867203834173287037504563","204335762952903595962534342966240590145","268387031900797246460199159345426967913","45814502169441225898448753155793946496","83360823220175707338854578383878608437","31319183621399506427760032520964789031","11708635858127335391340874892496361568","190440478496648337784724154648897555309","201426660522518771270666924947013732383","142878359944423747755849045403465154864","65550291800990674967875750758770963710","242361556861645650526696982187480303576","28069137344552139560470997066388902716","76336680946900526713332345378205036160","5962923548377693907383724983596227503","40397492080743711986548965896708986132","107354507051482376719592582656144860989","274225348374054510432941255424991356851","244550020315157905906035560896606407580","290844737857653336281577297897147513388","222170885541675270269338580915773502721"],"threshold":0.9},"id":"CVE-2026-4735-d2bf9789","signature_type":"Line","signature_version":"v1","source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6","target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/sink/KafkaSinkFactory.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["190293109800794163770011188678798136072","41928740038261452077526103916897313061","62142214413743892811568159258823571881","131503575994614813282279556093127640555"],"threshold":0.9},"id":"CVE-2026-4735-d87875b7","signature_type":"Line","signature_version":"v1","source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6","target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/source/KafkaSourceFactory.java"}},{"source":"https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6","target":{"file":"chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncConverter.java","function":"KafkaSyncConverter"},"deprecated":false,"digest":{"length":759,"function_hash":"94954219588609495378131824294805417688"},"id":"CVE-2026-4735-fa3e0db1","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Amber"}]}