Skip to content

Conversation

@scyt01
Copy link
Contributor

@scyt01 scyt01 commented Jul 17, 2025

Purpose of this pull request

This PR addresses a potential vulnerability in the read() function in chunjun-core/src/main/java/com/dtstack/chunjun/util/GsonUtil.java sourced from DTStack/chunjun that could lead to potential Denial of Service (DoS) risk and stack overflow due to recursive approach to handle JSON parsing. This issue, was originally reported and resolved in the repository via this commit google/gson@2d01d6a.

CVSS Rating: 7.5 (High)

Impact

  • Unbounded Recursion leading to Denial of Service (DoS) and Stack Overflow

Fix

  • Use an iterative approach to handle JSON parsing, making it more robust for deeply nested structures and less prone to stack overflow

References
google/gson@2d01d6a
https://nvd.nist.gov/vuln/detail/cve-2022-25647
https://nvd.nist.gov/vuln/detail/cve-2021-39144

@github-actions github-actions bot added the CORE label Jul 17, 2025
@aerbeisimeifannao
Copy link

aerbeisimeifannao commented Jul 17, 2025 via email

@yanghuaiGit yanghuaiGit merged commit 77a30fe into DTStack:master Nov 17, 2025
1 check passed
yanghuaiGit added a commit that referenced this pull request Nov 17, 2025
yanghuaiGit added a commit that referenced this pull request Nov 17, 2025
@yanghuaiGit
Copy link
Contributor

当前gson版本较低,您需要升级下gson版本,否则编译报错

@tabudz
Copy link

tabudz commented Nov 19, 2025

Hi @yanghuaiGit, thanks for merging our PR. Just want to let you know that I plan to report this as a CVE. Let us know if you have any concern!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants