Uncontrolled recursion in android-json allows denial of service
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-674.
Summary
The org.json parser in com.vaadin.external.google:android-json through 0.0.20131108.vaadin1 recurses once per nesting level without a depth limit, a flaw classified as CWE-674. A deeply nested JSON document of around 20 KB makes the parser throw a java.lang.StackOverflowError instead of a JSONException. A remote attacker without privileges or user interaction can make the thread parsing untrusted JSON fail.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released. Users of the affected version should apply the following mitigation. Product version com.vaadin.external.google:android-json 0.0.20131108.vaadin1 Mitigation No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for android-json. Replace the artifact with an org.json implementation that limits nesting depth, such as org.json:json 20231013 or later. Red Hat Fuse 7 is affected and has no fix planned.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-22 Threatist record created from CVE-2026-110974
- 2026-10-22 Alias added: GHSA-mpj5-6q3h-p6x6
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-30 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
More Vaadin vulnerabilities
- TI-2026-81073 Vaadin push endpoint reflects any Origin and allows credentials CVSS 4.0LOW 2.3
- TI-2026-78950 Session lock leak in Vaadin Framework 8 allows denial of service CVSS 4.0HIGH 8.7
- TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
- TI-2021-11542 Project sources exposure in Vaadin Designer CVSS 3.1HIGH 8.6
- TI-2026-78949 Multiple flaws in Highcharts bundled with Vaadin Charts CVSS 4.0HIGH 8.4
- TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
Sources
- CVE-2026-110974 · CVE Program
- CVE-2026-110974 · NVD
- FIRST EPSS
- GHSA-mpj5-6q3h-p6x6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-110974 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences