Open CVE with Newtonsoft.Json

[BC89]

During some our static scanning we have been seeing the following that's traceable to dependencies in this package.

Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS).

The serialization and deserialization path have different properties regarding the issue.

Seems like the recommendation is to update to a more recent version of Newtonsoft and do as described:

To mitigate the issue one either need to update Newtonsoft.Json to 13.0.1 or set MaxDepth parameter in the JsonSerializerSettings. This can be done globally with the following statement. After that the parsing of the nested input will fail fast with Newtonsoft.Json.JsonReaderException:
Wondering if this is on your radar to address?

Current version 16.0.0 .Net

[alfpark]

Please use assembly binding redirects in the meantime.

Tagging @dpwatrous