EUVD-2026-118487

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application...

CVE-2026-59171

The JSON-java library (versions 20150729 through 20260522 ) is vulnerable to a resource exhaustion attack. The JSONTokener.nextSimpleValue method can accumulate unbounded numeric tokens, which are subsequently processed by JSONObject.stringToNumber for BigInteger or BigDecimal conversion without ...