Vulnerability Disclosure Statement
Overview
Date of Disclosure: 22-05-2025
OpenLM is issuing this disclosure to inform clients about a known vulnerability in a third-party dependency used within main components of our licensed software product. The affected third-party dependency is the System.Text.Json library (version 6.0.0), which has been identified with a security vulnerability (CVE-2024-43485) by Microsoft.
While OpenLM does not develop or maintain this dependency directly, it is bundled within main components of our product. This issue will be fully addressed in the upcoming release of the main components, where the vulnerable dependency will be upgraded to a secure version.
We are issuing this disclosure in the interest of transparency, customer security, and responsible vulnerability management.
Affected Products/Services
| Product/Service Name | Version(s) Affected | Status |
| Main Components | Versions using System.Text.Json 6.0.0 | Update In Progress |
Vulnerability Summary
- CVE Identifier (if applicable): CVE-2024-43485
- Vulnerability Type: Denial of Service (DoS)
- CVSS Score: 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- Discovered by: Microsoft Security Response Center (MSRC)
- Discovery Date: 2024-10-08
Technical details
- Description: A vulnerability exists in System.Text.Json version 6.0.0, which could allow an attacker to trigger a denial-of-service (DoS) condition by submitting a specially crafted JSON payload. This affects applications that use the serializer to process untrusted JSON inputs.
- Impact: If exploited, this issue could result in high CPU usage, unresponsiveness, or crashes, potentially disrupting operations.
Mitigation & Resolution
Resolution Date: Planned for next patched version release
Remediation Actions: OpenLM has audited the usage of System.Text.Json within our main components and confirmed the vulnerability. We are actively working on:
- Updating the affected dependency to version 6.0.10 or later.
- Releasing a patched version that includes the secure version of the library.
This fix will be included in the next official release of the main components. Clients will be notified as soon as the updated version is available.
User Action Required: No immediate action required for customers who wait for the upcoming release.
Acknowledgement
OpenLM thanks the Microsoft Security Response Center for identifying and documenting this vulnerability, and our internal engineering team for auditing and addressing the issue.
Reference
