Unbounded numeric parsing in JSON-java enables denial of service
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.
Summary
JSON-java from 20150729 before 20260719 is affected. JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens that JSONObject.stringToNumber then converts with BigInteger or BigDecimal without a length limit. An unauthenticated remote attacker who can supply JSON or XML parsed through JSONObject, JSONArray or XML.toJSONObject can force super-linear CPU time with a long numeric literal, blocking request-handling threads (CWE-400). Strict mode and keep-strings settings do not prevent the affected path.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade stleary JSON-java to version 20260719, which limits numeric conversion length.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA JSON-java (stleary) Fixed in 20260719
Timeline
- 2026-11-06 Threatist record created from CVE-2026-59171
- 2026-11-08 Priority changed: MEDIUM → LOW
References
Other 7
- https://github.com/stleary/JSON-java/security/advisories/GHSA-ghc9-756g-vrcv
- https://github.com/stleary/JSON-java/pull/1065
- https://github.com/stleary/JSON-java/pull/1067
- https://github.com/stleary/JSON-java/commit/703ac34a55400f9c50889e3d0c778b6d7962e81c
- https://github.com/stleary/JSON-java/commit/ab92bb9088a37f9e346cd1dda66f6a3c40a201e0
- https://github.com/stleary/JSON-java/commit/fce83c91bb229dde472283dea648a9a8955237fd
- https://github.com/stleary/JSON-java/releases/tag/20260719
More stleary vulnerabilities
- TI-2022-22552 A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of… CVSS 3.1HIGH 7.5
- TI-2022-22550 A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows… CVSS 3.1HIGH 7.5
- TI-2023-04667 DoS Vulnerability in JSON-Java CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences