CVE-2022-3433

The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.

• CWE-328
• CWE-326

• https://cs-syd.eu/posts/2021-09-11-json-vulnerabilityExploit, Patch, Technical Description, Third Party Advisory
• https://cs-syd.eu/posts/2021-09-11-json-vulnerabilityExploit, Patch, Technical Description, Third Party Advisory

Published

Oct 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34323Multiple XSS issues were discovered in Sage XRT Business Exc…5.4
• CVE-2022-34324Multiple SQL injections in Sage XRT Business Exchange 12.4.3…8.8
• CVE-2022-34325DMA transactions which are targeted at input buffers used fo…7.8
• CVE-2022-34326In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on…7.5
• CVE-2022-34328PMB 7.3.10 allows reflected XSS via the id parameter in an l…6.1
• CVE-2022-34329 IBM CICS TX 11.7 could allow an attacker to obtain sensitiv…5.3
• CVE-2022-34330IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through…6.1
• CVE-2022-34331After performing a sequence of Power FW950, FW1010 maintena…9.8
• CVE-2022-34333 IBM Sterling Order Management 10.0 does not require that us…7.5
• CVE-2022-34334IBM Sterling Partner Engagement Manager 2.0 does not invalid…6.5
• CVE-2022-34335 IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6…6.5
• CVE-2022-34336IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is v…5.4