{"id":"CVE-2026-113602","kind":"vulnerability","aliases":["CVE-2026-113602"],"related":[],"title":"json-smart: strict-mode validation bypass lets malformed JSON pass checks","description":"json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.","summary":"json-smart through 2.6.0 lets an attacker append a literal 0x1A byte to bypass its strict-mode trailing-data check, so malformed JSON passes JSONValue.parseStrict or isValidJsonStrict. The mismatch can make a validated payload parse differently in downstream parsers such as Jackson or Gson.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gson","jackson","java","json-smart","maven","package"],"not_affected_if":["does-not-use-strict-validation","json-smart-not-present"],"how_to_check":"- Look for json-smart in dependency manifests and lockfiles (for Maven, `mvn dependency:tree | grep json-smart`)\n- Check the resolved json-smart version; affected versions are `2.6.0` and earlier\n- Find code calling `JSONValue.parseStrict` or `isValidJsonStrict` and note whether that validation gates other parsers","fix":"- Upgrade json-smart to a release newer than `2.6.0` (fixed version unknown from sources)\n- Until patched, do not rely on json-smart strict validation as the only input check; validate with the downstream parser too","status":"open","published_at":"2026-10-20T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:40:30+00:00","updated_at":"2026-10-25T03:40:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade json-smart to a release newer than `2.6.0` (fixed version unknown from sources)\n- Until patched, do not rely on json-smart strict validation as the only input check; validate with the downstream parser too","reach":"unknown","title":"json-smart: strict-mode validation bypass lets malformed JSON pass checks","impact":"medium","summary":"json-smart through 2.6.0 lets an attacker append a literal 0x1A byte to bypass its strict-mode trailing-data check, so malformed JSON passes JSONValue.parseStrict or isValidJsonStrict. The mismatch can make a validated payload parse differently in downstream parsers such as Jackson or Gson.","category":"package","nicknames":[],"who_cares":["java","json-smart","jackson","gson","maven"],"confidence":0.6,"needs_auth":"unknown","worst_case":"malformed JSON passes validation and is parsed differently downstream","analyst_note":"Find the fixed json-smart version and any advisory text on the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-113602) to confirm the patched release and the exact downstream impact.","how_to_check":"- Look for json-smart in dependency manifests and lockfiles (for Maven, `mvn dependency:tree | grep json-smart`)\n- Check the resolved json-smart version; affected versions are `2.6.0` and earlier\n- Find code calling `JSONValue.parseStrict` or `isValidJsonStrict` and note whether that validation gates other parsers","needs_analyst":true,"not_affected_if":["does-not-use-strict-validation","json-smart-not-present"],"who_is_affected":"Applications that use json-smart strict-mode validation to decide whether incoming JSON is safe, then hand the same bytes to another parser like Jackson or Gson. A service that only uses json-smart for lenient parsing, or never validates with strict mode, is less exposed. The sources do not describe a remote-only trigger path, so exposure depends on where the input comes from.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":3344,"output_tokens":740,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113602':16A,19A '-2026':15A,18A '0x1a':39B,102C,107C '2.6.0':32B,79C 'allow':87C 'append':36B,106C 'attack':35B,88C,104C 'bypass':8A,42B,84C 'byte':40B 'charact':103C 'check':13A,50B,97C 'contain':80C 'content':110C 'creat':117C 'cve':14A,17A 'data':49B,96C 'differ':66B 'differenti':119C 'downstream':68B,121C 'evad':90C 'gson':20B,74B,126C 'input':82C 'insert':99C 'isvalidjsonstrict':57B,115C 'jackson':21B,72B,124C 'java':22B 'json':2A,11A,24B,29B,53B,76C 'json-smart':1A,23B,28B,75C 'jsonvalue.parsestrict':55B,113C 'let':9A,33B 'like':123C 'liter':38B,101C 'make':61B 'malform':10A,52B,109C 'maven':26B 'mismatch':59B 'mode':6A,46B,93C 'packag':27B 'pars':65B 'parser':69B,118C,122C 'pass':12A,54B,112C 'payload':64B 'smart':3A,25B,30B,77C 'strict':5A,45B,92C 'strict-mod':4A,44B,91C 'trail':48B,95C 'trailing-data':47B,94C 'valid':7A,63B,83C,116C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Applications that use json-smart strict-mode validation to decide whether incoming JSON is safe, then hand the same bytes to another parser like Jackson or Gson. A service that only uses json-smart for lenient parsing, or never validates with strict mode, is less exposed. The sources do not describe a remote-only trigger path, so exposure depends on where the input comes from.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113602","severity":null,"published_at":"2026-10-20T16:17:09+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}