Live › vulnerability › CVE-2026-113602
Go to dashboardjson-smart through 2.6.0 lets an attacker append a literal 0x1A byte to bypass its strict-mode trailing-data check, so malformed JSON passes JSONValue.parseStrict or isValidJsonStrict. The mismatch can make a validated payload parse differently in downstream parsers such as Jackson or Gson.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use json-smart strict-mode validation to decide whether incoming JSON is safe, then hand the same bytes to another parser like Jackson or Gson. A service that only uses json-smart for lenient parsing, or never validates with strict mode, is less exposed. The sources do not describe a remote-only trigger path, so exposure depends on where the input comes from.
No product ranges from the sources yet.
mvn dependency:tree | grep json-smart)2.6.0 and earlierJSONValue.parseStrict or isValidJsonStrict and note whether that validation gates other parsers2.6.0 (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.
This page as .md · .json · in your agent: get_signal("CVE-2026-113602")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.