{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2023-3040",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2023-3040",
    "idYear": 2023,
    "status": "PUBLISHED",
    "publishedAt": "2023-06-14T11:54:51.131Z",
    "updatedAt": "2025-01-02T19:21:32.890Z",
    "importedAt": "2026-10-24T01:56:58.683Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Out of Bounds Access Leading to Undefined Behavior",
      "summary": "A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse untrusted input data. It is important to note that because this debug function was only used in tests and demos, it was not exploitable in a normal environment.\n",
      "affected": [
        {
          "vendor": "Cloudflare",
          "product": "lua-resty-json",
          "packageName": "lua-resty-json",
          "platforms": [
            "Windows",
            "Linux",
            "MacOS",
            "x86",
            "64 bit",
            "32 bit"
          ],
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "14",
              "changes": [
                {
                  "at": "14",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  }
}