Live › vulnerability › CVE-2026-110974
Go to dashboardThe org.json parser in com.vaadin.external.google:android-json recurses without a depth limit, so a deeply nested JSON document of about 20 KB makes parsing throw a raw StackOverflowError. An attacker who can send JSON to an application using this library can make the parsing thread fail, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that parse untrusted JSON with the Vaadin-repackaged android-json artifact are exposed, because any request body or input that reaches the parser can trigger the failure. Applications that do not depend on this artifact, or that only parse trusted JSON, can skip it.
No product ranges from the sources yet.
com.vaadin.external.google:android-json in the dependency tree, for example with mvn dependency:tree or gradle dependencies.0.0.20131108.vaadin1 is affected.com.vaadin.external.google:android-json 0.0.20131108.vaadin1 with an org.json implementation that limits nesting depth, such as org.json:json 20231013 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.
Users of the affected version should apply the following mitigation.
Product version com.vaadin.external.google:android-json 0.0.20131108.vaadin1
Mitigation No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.
Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none
This page as .md · .json · in your agent: get_signal("CVE-2026-110974")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.