ECHO-5b91-c100-b90d
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-5b91-c100-b90d.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ECHO-5b91-c100-b90d
- Upstream
- Withdrawn
- 2026-11-03T07:57:17Z
- Published
- 2026-10-05T00:00:26Z
- Modified
- 2026-11-03T12:45:02Z
- Summary
- Stack exhaustion on input with a large number of '{'. The advisory lists the affected range as 2.5.0 - 2.5.1 (fixed in 2.5.2) and calls it an incomplete fix for CVE-2023-1370: 2.5.0 made the depth limit conditional (`limitJsonDepth`, set by the LIMIT_JSON_DEPTH option, added in commit da2e833), and parsers built with custom options left it off. That conditional code does not exist in 2.4.11: JSONParserBase.readArray and readObject apply the MAX_DEPTH = 400 check unconditionally in every parser mode. trivy flags 2.4.11 anyway, but GitHub's advisory range starts at 2.5.0.
- Details
- References