CVE-2024-23080
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
Joda Time v2.12.5 was reported to have a potential NullPointerException in the `wordBased(Locale)` method of the `PeriodFormat` class. However, this is disputed by multiple third parties who believe there is insufficient evidence for the vulnerability, and the submission may have originated from a tool not robust enough for vulnerability identification.
Risk Assessment
If the vulnerability is real, it could cause unexpected application termination (DoS) when processing formatted time periods with specific locales. The risk is low due to the disputed nature of the finding.
Recommendation
Monitor official Joda Time updates and consider temporarily avoiding the `wordBased` method with non-default locales if feasible. Apply a patch if the vulnerability is confirmed.
Original NVD description (English source)
Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.