---
id: "CVE-2026-110974"
kind: "vulnerability"
aliases: ["CVE-2026-110974"]
title: "Vaadin android-json: deep JSON nesting crashes the parsing thread with StackOverflowError"
severity: "medium"
cvss: 6.3
epss: 0.00253
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gradle", "java", "maven", "package", "self-hosted", "vaadin"]
not_affected_if: ["artifact-not-present", "no-untrusted-json"]
published_at: "2026-10-22T09:17:13+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:01:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110974", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110974", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Vaadin android-json: deep JSON nesting crashes the parsing thread with StackOverflowError

The org.json parser in com.vaadin.external.google:android-json recurses without a depth limit, so a deeply nested JSON document of about 20 KB makes parsing throw a raw StackOverflowError. An attacker who can send JSON to an application using this library can make the parsing thread fail, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `com.vaadin.external.google:android-json` in the dependency tree, for example with `mvn dependency:tree` or `gradle dependencies`.
- Confirm the version: `0.0.20131108.vaadin1` is affected.

## Fix

- Replace `com.vaadin.external.google:android-json` `0.0.20131108.vaadin1` with an org.json implementation that limits nesting depth, such as `org.json:json` `20231013` or later.
- No fixed version of the Vaadin artifact will be released.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110974
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110974

## From the sources

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.


Users of the affected version should apply the following mitigation.

Product version
com.vaadin.external.google:android-json 0.0.20131108.vaadin1

Mitigation
No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.

Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_