{"id":"CVE-2026-59171","kind":"vulnerability","aliases":["CVE-2026-59171"],"related":[],"title":"JSON-java: unbounded numeric literals let parsing stall request threads","description":"JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.","summary":"JSON-java is a Java library for reading JSON and XML. A very long numeric value in attacker-supplied input makes the parser spend super-linear CPU time converting it, which can block request-handling threads and cause denial of service.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","json-java","org.json","package"],"not_affected_if":["trusted-input-only","version-outside-range"],"how_to_check":"- Find JSON-java in the project's dependencies (for example `org.json:json` in Maven or Gradle files) and note the version.\n- Check whether that version is between `20150729` and `20260522` inclusive.\n- Look for code that parses untrusted input with JSONObject, JSONArray or XML.toJSONObject.","fix":"- JSON-java: move to `20260719`, which limits numeric conversion length.","status":"open","published_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","triaged_at":"2026-11-06T21:46:47+00:00","updated_at":"2026-11-06T21:46:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T21:46:47Z","model":"claude-haiku-5-5","output":{"fix":"- JSON-java: move to `20260719`, which limits numeric conversion length.","reach":"network","title":"JSON-java: unbounded numeric literals let parsing stall request threads","impact":"low","summary":"JSON-java is a Java library for reading JSON and XML. A very long numeric value in attacker-supplied input makes the parser spend super-linear CPU time converting it, which can block request-handling threads and cause denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","json-java","org.json"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Request threads block on CPU-heavy number conversion, causing denial of service.","analyst_note":"","how_to_check":"- Find JSON-java in the project's dependencies (for example `org.json:json` in Maven or Gradle files) and note the version.\n- Check whether that version is between `20150729` and `20260522` inclusive.\n- Look for code that parses untrusted input with JSONObject, JSONArray or XML.toJSONObject.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","version-outside-range"],"who_is_affected":"Applications that pass attacker-controlled JSON or XML into JSONObject, JSONArray or XML.toJSONObject are exposed, because a long numeric literal can tie up a thread. Strict mode and keep-strings settings do not prevent the affected path. Systems that only parse trusted, internally produced JSON can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":4418,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59171':14A,17A '20150729':84C '20260522':86C '20260719':161C 'accumul':89C 'affect':157C 'applic':107C 'attack':43B,111C 'attacker-control':110C 'attacker-suppli':42B 'bigdecim':100C 'biginteg':98C 'block':59B,134C 'caus':65B,140C 'control':112C 'convers':101C,158C,164C 'convert':55B,128C 'cpu':53B,126C 'cve':12A,15A 'denial':66B,141C 'handl':62B,137C 'implement':75C 'input':45B 'java':3A,18B,21B,26B,29B,71C,81C 'json':2A,20B,25B,33B,70C,78C,113C 'json-java':1A,19B,24B,69C 'jsonarray':118C 'jsonobject':117C 'jsonobject.stringtonumber':94C 'jsonparserconfigur':152C 'jsontokener.nextsimplevalue':87C 'keep':148C 'keep-str':147C 'length':104C,165C 'let':7A 'librari':30B 'limit':105C,162C 'linear':52B,125C 'liter':6A,133C 'long':38B,131C 'make':46B 'mode':145C 'numer':5A,39B,91C,132C,163C 'org.json':22B 'packag':23B,79C 'pars':8A,109C 'parser':48B 'pass':95C 'path':159C 'prevent':155C 'read':32B 'refer':74C 'request':10A,61B,136C 'request-handl':60B,135C 'servic':68B,143C 'set':150C 'spend':49B,122C 'stall':9A 'strict':144C 'string':149C 'suffici':130C 'super':51B,124C 'super-linear':50B,123C 'suppli':44B 'thread':11A,63B,138C 'time':54B,127C 'token':92C 'unbound':4A,90C 'valu':40B 'version':83C,160C 'without':102C 'xml':35B,115C 'xml.tojsonobject':120C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass attacker-controlled JSON or XML into JSONObject, JSONArray or XML.toJSONObject are exposed, because a long numeric literal can tie up a thread. Strict mode and keep-strings settings do not prevent the affected path. Systems that only parse trusted, internally produced JSON can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","jsonjava","medium","orgjson","package"],"campaign_type":null,"search_a":"'-2026':13A,16A '-59171':14A,17A 'cve':12A,15A 'java':3A 'json':2A 'json-java':1A 'let':7A 'liter':6A 'numer':5A 'pars':8A 'request':10A 'stall':9A 'thread':11A 'unbound':4A","search_b":"'attack':43B 'attacker-suppli':42B 'block':59B 'caus':65B 'convert':55B 'cpu':53B 'denial':66B 'handl':62B 'input':45B 'java':18B,21B,26B,29B 'json':20B,25B,33B 'json-java':19B,24B 'librari':30B 'linear':52B 'long':38B 'make':46B 'numer':39B 'org.json':22B 'packag':23B 'parser':48B 'read':32B 'request':61B 'request-handl':60B 'servic':68B 'spend':49B 'super':51B 'super-linear':50B 'suppli':44B 'thread':63B 'time':54B 'valu':40B 'xml':35B","search_c":"'20150729':84C '20260522':86C '20260719':161C 'accumul':89C 'affect':157C 'applic':107C 'attack':111C 'attacker-control':110C 'bigdecim':100C 'biginteg':98C 'block':134C 'caus':140C 'control':112C 'convers':101C,158C,164C 'convert':128C 'cpu':126C 'denial':141C 'handl':137C 'implement':75C 'java':71C,81C 'json':70C,78C,113C 'json-java':69C 'jsonarray':118C 'jsonobject':117C 'jsonobject.stringtonumber':94C 'jsonparserconfigur':152C 'jsontokener.nextsimplevalue':87C 'keep':148C 'keep-str':147C 'length':104C,165C 'limit':105C,162C 'linear':125C 'liter':133C 'long':131C 'mode':145C 'numer':91C,132C,163C 'packag':79C 'pars':109C 'pass':95C 'path':159C 'prevent':155C 'refer':74C 'request':136C 'request-handl':135C 'servic':143C 'set':150C 'spend':122C 'strict':144C 'string':149C 'suffici':130C 'super':124C 'super-linear':123C 'thread':138C 'time':127C 'token':92C 'unbound':90C 'version':83C,160C 'without':102C 'xml':115C 'xml.tojsonobject':120C","first_public_at":"2026-08-01T12:48:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59171","severity":null,"published_at":"2026-11-06T21:17:09+00:00","modified_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","fetched_at":"2026-11-06T21:45:07+00:00","note":null}],"documents":[{"id":90315,"url":"https://github.com/stleary/JSON-java/commit/703ac34a55400f9c50889e3d0c778b6d7962e81c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90316,"url":"https://github.com/stleary/JSON-java/commit/ab92bb9088a37f9e346cd1dda66f6a3c40a201e0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90317,"url":"https://github.com/stleary/JSON-java/commit/fce83c91bb229dde472283dea648a9a8955237fd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90318,"url":"https://github.com/stleary/JSON-java/releases/tag/20260719","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90319,"url":"https://github.com/stleary/JSON-java/security/advisories/GHSA-ghc9-756g-vrcv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-01T12:48:08+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}