CVE-2026-59171

🗓️ 06 Nov 2026 20:12:34Reported by MendType

Unbounded numeric tokens in JSON-java cause DoS via super-linear CPU time.

Reporter	Title	Published	Views	Family All 146
Chainguard	CVE-2026-59171 vulnerabilities	10 Nov 202616:52	–	cgr
Circl	CVE-2026-59171	6 Nov 202620:20	–	circl
CVE	CVE-2026-59171	6 Nov 202620:12	–	cve
Cvelist	CVE-2026-59171 JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoS	6 Nov 202620:12	–	cvelist
EUVD	EUVD-2026-118487	9 Nov 202621:12	–	euvd
Github Security Blog	JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS	9 Nov 202621:12	–	github
NVD	CVE-2026-59171	6 Nov 202621:17	–	nvd
osv_cga	CGA-27P5-P23H-MC2X	10 Nov 202613:07	–	osv_cga
osv_cga	CGA-2F6P-GGQ4-4P8X	10 Nov 202612:00	–	osv_cga
osv_cga	CGA-2G7J-V5HH-WFMV	10 Nov 202613:36	–	osv_cga

Vulners

Node

stleary json-javaRange20150729–20260719

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59171
github	www.github.com/stleary/JSON-java/releases/tag/20260719
github	www.github.com/stleary/JSON-java/pull/1065
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59171.json
github	www.github.com/stleary/JSON-java/pull/1067
github	www.github.com/stleary/JSON-java/commit/ab92bb9088a37f9e346cd1dda66f6a3c40a201e0
github	www.github.com/stleary/JSON-java/commit/703ac34a55400f9c50889e3d0c778b6d7962e81c
github	www.github.com/stleary/JSON-java/security/advisories/GHSA-ghc9-756g-vrcv
github	www.github.com/stleary/JSON-java/commit/fce83c91bb229dde472283dea648a9a8955237fd

09 Nov 2026 10:28Current

6Medium risk

Vulners AI Score6

CVSS 3.15.9

CVSS 48.2

EPSS0.00552