Description

An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T16:17:46.550Z",
  "pubdate": "2026-08-28T16:17:46.550Z",
  "executiveSummary": "The OWASP json-sanitizer library, specifically version 1.2.3, contains a vulnerability within the JsonSanitizer.sanitize() function that permits a Denial of Service (DoS) attack.\nThe vulnerability type is classified as a resource exhaustion or algorithmic complexity issue triggered by maliciously crafted input data.\nSuccessful exploitation allows an unauthenticated remote attacker to disrupt application availability by forcing the sanitization process into a state that consumes excessive CPU or memory resources.\nThe risk implication is significant for services relying on the library for processing untrusted JSON inputs, as this flaw enables a trivial vector for crashing the hosting process.\nExploitation requires no special privileges or authentication, necessitating only the ability to supply input to the affected sanitizer component.\nThe vulnerability impacts system stability by causing the application to hang or crash when processing the specially prepared payload.",
  "technicalDetails": "The vulnerability resides within the core logic of the JsonSanitizer.sanitize() method, which is responsible for parsing and sanitizing untrusted JSON-like input strings. The root cause pertains to an inefficient handling of complex or malformed structures, likely manifesting as excessive backtracking or recursive resource consumption when encountering specifically crafted nested or repetitive sequences.\nDuring the sanitization lifecycle, the library parses input to neutralize potentially malicious content (such as script injection vectors). When presented with a maliciously crafted input, the parser's logic becomes trapped in an inefficient state. This behavior is indicative of a 'reDoS' (Regular Expression Denial of Service) variant or a similar complexity-based performance degradation, where the time complexity of the sanitization operation scales super-linearly relative to the input length.\nThe attack flow proceeds as follows: An attacker identifies an application endpoint or interface that invokes JsonSanitizer.sanitize() on user-supplied content. The attacker constructs a payload designed to maximize the computational overhead of the library's internal state machine. Upon submission, the target system passes the payload to the library. The sanitize() function initiates recursive or repetitive processing logic to validate the input; due to the structure of the input, the process enters a high-latency loop or triggers an unhandled memory growth pattern. This forces the host process to saturate CPU cores or exhaust available heap memory, effectively rendering the application unresponsive to legitimate traffic.\nThe vulnerable component is identified as the JsonSanitizer.sanitize() function within the OWASP json-sanitizer library version 1.2.3. As this function is intended to handle untrusted input, the attack surface is wide, potentially including any web form, API parameter, or background processing job that relies on this library for cleaning serialized JSON data. No authentication or specific privilege level is required to trigger this condition, as the input is typically processed before any application-level authorization logic. Post-exploitation, the impact is a complete disruption of service, necessitating a restart of the application instance to restore functionality. The vulnerability is characterized by its simplicity of execution and the low overhead required for the attacker to maintain the denial-of-service state."
}