{"id":"RHLW-2026-c44e4cf8dcda3e35","summary":"Lightwell Security Advisory: json-smart 2.5.1.rhlw-00001","details":"Red Hat Lightwell has released net.minidev:json-smart 2.5.1.rhlw-00001 with a backported security fix.\n\nCVE-2024-57699: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.\n\nThis patched artifact is a drop-in replacement for net.minidev:json-smart 2.5.1 from Maven Central.","modified":"2026-10-27T04:00:13.858721885Z","published":"2026-10-08T19:45:38Z","upstream":["CVE-2024-57699","GHSA-pq2g-wx69-c263"],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/cve-2023-1370"},{"type":"WEB","url":"https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57699"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pq2g-wx69-c263"}],"affected":[{"package":{"name":"net.minidev:json-smart","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/net.minidev/json-smart"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1.rhlw-00001"}]}],"versions":["1.0.6.3","1.0.8","1.0.9","1.0.9-1","1.1","1.1.1","1.2","1.3","1.3.1","1.3.2","1.3.3","2.0","2.0-RC1","2.0-RC2","2.0-RC3","2.1.0","2.1.1","2.2","2.2.1","2.3","2.3.1","2.4.1","2.4.10","2.4.11","2.4.2","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1"],"database_specific":{"lightwell":{"repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"2.5.1","remediated_version":"2.5.1.rhlw-00001"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-c44e4cf8dcda3e35.json"}}],"schema_version":"1.9.2","credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}