Hutool

15 CVEs across 1 Hutool products. Browse Hutool vulnerabilities, severities, and proof-of-concept exploits.

Hutool products with known CVEs

ProductCVEs
Hutool15
Hutool CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-56769Medium6.52025-09-25An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and p…
CVE-2023-51080High7.52023-12-27The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.
CVE-2023-51075High7.52023-12-27hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial…
CVE-2023-42278High7.52023-09-08hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().
CVE-2023-42277Critical9.82023-09-08hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.
CVE-2023-42276Critical9.82023-09-08hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.
CVE-2023-33695High7.12023-06-13Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.
CVE-2023-24163Critical9.82023-01-31SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.
CVE-2023-24162Critical9.82023-01-31Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.
CVE-2022-4565Medium4.32022-12-16A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.Zip…
CVE-2022-45690High7.52022-12-13A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) v…
CVE-2022-45689High7.52022-12-13hutool-json v5.8.10 was discovered to contain an out of memory error.
CVE-2022-45688High7.52022-12-13A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
CVE-2022-22885Critical9.82022-02-16Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.
CVE-2018-17297High7.52018-09-21The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename…