Skip to content
OpenAdvisories

Product · vaadin

android-json

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-110974

    Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

    The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested…

    vaadin android-json Android