Description
JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| stleary | JSON-java | >= 20150729, < 20260719 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | json-java | 20260814-1.1 | openSUSE-SU-2026:12514-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.28.0-r17 | — |
| Wolfi rolling | apicurio-registry | 3.3.4-r1 | — |
| Wolfi rolling | dependency-track +1 | 4.14.6-r1 | — |
| Wolfi rolling | flyway +1 | No fix yet | — |
| Wolfi rolling | jenkins-plugin-manager | 2.16.0-r1 | — |
| Wolfi rolling | opensearch-3-sql +5 | 3.9.0-r9 | — |
| Wolfi rolling | spdx-tools-java | 2.0.7-r12 | — |
| Wolfi rolling | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.3.1-r1 | — |
| Wolfi rolling | thingsboard-tb-node +1 | 4.4.0.2-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.json:json | >= 20150729, < 20260719 | 20260719 | GHSA-ghc9-756g-vrcv |
Advisories 1
- openSUSE-SU-2026:12514-1 json-java-20260814-1.1 on GA media SUSE / openSUSE Security Updates · Nov 11, 2026
References
- https://github.com/stleary/JSON-java/security/advisories/GHSA-ghc9-756g-vrcv
- https://github.com/stleary/JSON-java/pull/1065
- https://github.com/stleary/JSON-java/pull/1067
- https://github.com/stleary/JSON-java/commit/703ac34a55400f9c50889e3d0c778b6d7962e81c
- https://github.com/stleary/JSON-java/commit/ab92bb9088a37f9e346cd1dda66f6a3c40a201e0
- https://github.com/stleary/JSON-java/commit/fce83c91bb229dde472283dea648a9a8955237fd
- https://github.com/stleary/JSON-java/releases/tag/20260719