Strict-mode validation bypass in json-smart via 0x1A character
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
json-smart through 2.6.0 contains an input validation bypass in its strict mode. A remote attacker without privileges or user interaction can evade trailing-data checks by including a literal 0x1A character, which lets malformed input pass JSONValue.parseStrict or isValidJsonStrict validation (CWE-147). The result is a parser differential with downstream parsers such as Jackson or Gson, with low integrity impact.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| json-smart | json-smart | up to 2.6.0 | — | No fix listed | CNA |
- json-smart Vendorjson-smart Affected up to 2.6.0 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for json-smart. Red Hat lists these products as affected without a fix: OpenShift Developer Tools and Services (no fix planned), OpenShift Serverless (none available), Red Hat Data Grid 8 (none available), Red Hat Fuse 7 (no fix planned), Red Hat OpenShift Dev Spaces (none available) and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix planned: Out of support scope |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-20 Threatist record created from CVE-2026-113602
- 2026-10-20 CISA SSVC decision points changed
- 2026-10-20 Priority changed: MEDIUM → HIGH
- 2026-10-21 Alias added: GHSA-77mf-7xf5-w9wc
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-21 CVSS score added · Red Hat
References
Sources
- CVE-2026-113602 · CVE Program
- CVE-2026-113602 · NVD
- FIRST EPSS
- GHSA-77mf-7xf5-w9wc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-113602 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences