---
id: "CVE-2026-113602"
kind: "vulnerability"
aliases: ["CVE-2026-113602"]
title: "json-smart: strict-mode validation bypass lets malformed JSON pass checks"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gson", "jackson", "java", "json-smart", "maven", "package"]
not_affected_if: ["does-not-use-strict-validation", "json-smart-not-present"]
published_at: "2026-10-20T16:17:09+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:40:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113602", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# json-smart: strict-mode validation bypass lets malformed JSON pass checks

json-smart through 2.6.0 lets an attacker append a literal 0x1A byte to bypass its strict-mode trailing-data check, so malformed JSON passes JSONValue.parseStrict or isValidJsonStrict. The mismatch can make a validated payload parse differently in downstream parsers such as Jackson or Gson.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for json-smart in dependency manifests and lockfiles (for Maven, `mvn dependency:tree | grep json-smart`)
- Check the resolved json-smart version; affected versions are `2.6.0` and earlier
- Find code calling `JSONValue.parseStrict` or `isValidJsonStrict` and note whether that validation gates other parsers

## Fix

- Upgrade json-smart to a release newer than `2.6.0` (fixed version unknown from sources)
- Until patched, do not rely on json-smart strict validation as the only input check; validate with the downstream parser too

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113602

## From the sources

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_