{"id":"CVE-2026-110974","kind":"vulnerability","aliases":["CVE-2026-110974"],"related":[],"title":"Vaadin android-json: deep JSON nesting crashes the parsing thread with StackOverflowError","description":"The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.\n\n\nUsers of the affected version should apply the following mitigation.\n\nProduct version\ncom.vaadin.external.google:android-json 0.0.20131108.vaadin1\n\nMitigation\nNo fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.\n\nArtifacts\nMaven coordinates / Vulnerable versions / Fixed version\ncom.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none","summary":"The org.json parser in com.vaadin.external.google:android-json recurses without a depth limit, so a deeply nested JSON document of about 20 KB makes parsing throw a raw StackOverflowError. An attacker who can send JSON to an application using this library can make the parsing thread fail, causing a denial of service.","severity":"medium","cvss":6.3,"epss":0.00253,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gradle","java","maven","package","self-hosted","vaadin"],"not_affected_if":["artifact-not-present","no-untrusted-json"],"how_to_check":"- Look for `com.vaadin.external.google:android-json` in the dependency tree, for example with `mvn dependency:tree` or `gradle dependencies`.\n- Confirm the version: `0.0.20131108.vaadin1` is affected.","fix":"- Replace `com.vaadin.external.google:android-json` `0.0.20131108.vaadin1` with an org.json implementation that limits nesting depth, such as `org.json:json` `20231013` or later.\n- No fixed version of the Vaadin artifact will be released.","status":"open","published_at":"2026-10-22T09:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:01:16+00:00","updated_at":"2026-10-25T04:01:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:01:16Z","model":"claude-haiku-5-5","output":{"fix":"- Replace `com.vaadin.external.google:android-json` `0.0.20131108.vaadin1` with an org.json implementation that limits nesting depth, such as `org.json:json` `20231013` or later.\n- No fixed version of the Vaadin artifact will be released.","reach":"unknown","title":"Vaadin android-json: deep JSON nesting crashes the parsing thread with StackOverflowError","impact":"low","summary":"The org.json parser in com.vaadin.external.google:android-json recurses without a depth limit, so a deeply nested JSON document of about 20 KB makes parsing throw a raw StackOverflowError. An attacker who can send JSON to an application using this library can make the parsing thread fail, causing a denial of service.","category":"package","nicknames":[],"who_cares":["java","vaadin","maven","gradle","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Parsing thread crashes with StackOverflowError, causing denial of service","analyst_note":"","how_to_check":"- Look for `com.vaadin.external.google:android-json` in the dependency tree, for example with `mvn dependency:tree` or `gradle dependencies`.\n- Confirm the version: `0.0.20131108.vaadin1` is affected.","needs_analyst":false,"not_affected_if":["no-untrusted-json","artifact-not-present"],"who_is_affected":"Applications that parse untrusted JSON with the Vaadin-repackaged android-json artifact are exposed, because any request body or input that reaches the parser can trigger the failure. Applications that do not depend on this artifact, or that only parse trusted JSON, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":3644,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110974':16A,19A '-2026':15A,18A '0.0.20131108':195C,234C '20':49B,112C '2013':159C '20231013':220C 'affect':182C 'android':3A,34B,86C,193C,232C 'android-json':2A,33B,85C,192C,231C 'appli':185C 'applic':65B,137C 'around':111C 'array':116C 'artifact':156C,206C,223C 'attack':58B 'call':98C,103C 'caus':75B 'class':166C 'com.vaadin.external.google':32B,84C,191C,230C 'constructor':127C 'coordin':225C 'crash':8A 'cve':14A,17A 'deep':5A 'deepli':43B,107C 'default':119C 'denial':77B 'depth':39B,95C,215C 'document':46B,110C 'fail':74B,149C 'fix':174C,199C,228C 'follow':187C 'gradl':20B 'host':26B 'implement':210C 'instead':132C 'java':21B 'java.lang.stackoverflowerror':131C 'json':4A,6A,35B,45B,62B,87C,109C,141C,194C,219C,233C 'jsonarray':124C 'jsonexcept':135C 'jsonobject':126C 'jsontokener.nextvalue':97C 'kb':50B,113C 'later':222C 'level':92C 'librari':68B,144C 'limit':40B,96C,212C 'made':147C 'maintain':171C 'make':51B,70B,122C 'maven':22B,224C 'mitig':188C,197C 'nest':7A,44B,91C,108C,115C,214C 'never':170C 'nextvalu':104C 'none':236C 'org.json':29B,81C,165C,209C,218C 'packag':23B 'pars':10A,52B,72B,139C,154C 'parser':30B,82C 'parti':164C 'per':90C 'product':189C 'publish':167C 'raw':55B,130C 'readarray':99C 'readobject':101C 'recurs':36B,88C 'releas':178C,203C 'repackag':160C 'replac':204C 'self':25B 'self-host':24B 'send':61B 'servic':79B 'stack':121C 'stackoverflowerror':13A,56B 'third':163C 'third-parti':162C 'thread':11A,73B,120C,151C 'throw':53B,128C 'untrust':140C 'use':66B 'user':179C 'vaadin':1A,27B 'vaadin1':196C,235C 'version':175C,183C,190C,200C,227C,229C 'vulner':226C 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Applications that parse untrusted JSON with the Vaadin-repackaged android-json artifact are exposed, because any request body or input that reaches the parser can trigger the failure. Applications that do not depend on this artifact, or that only parse trusted JSON, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@vaadin.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110974","severity":null,"published_at":"2026-10-22T09:17:13+00:00","modified_at":"2026-10-22T15:37:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110974","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110974","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}