Skip to content
OpenAdvisories
High · 7.5 CVE-2026-9563 EUVD-2026-41258GHSA-q86x-4w7f-8hrm

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number …

Published Jul 2, 2026 · Updated Jul 2, 2026 · Assigned by eclipse

Vendor: Eclipse Foundation Product: Eclipse Parsson Package: keycloak-26.6 Package: keycloak-26.6-iamguarded-compat Ecosystem: Wolfi

Description

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.

Affected products

VendorProductAffectedFixed
Eclipse Foundation Eclipse Parsson 1.0.0 – ≤ 1.1.7 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling keycloak-26.6 +1 26.6.7-r3 —

Advisories 9

References