SUSE CVE-2026-59171

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application...

EUVD-2026-118487

JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS...

GHSA-GHC9-756G-VRCV JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS

Executive Summary JSON-java version 20260522 contains an unguarded path from an HTTP request body to unbounded BigInteger and BigDecimal construction. JSONTokener.nextSimpleValue accumulates numeric characters into a StringBuilder with no length cap, then passes the full string to...

JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS

Executive Summary JSON-java version 20260522 contains an unguarded path from an HTTP request body to unbounded BigInteger and BigDecimal construction. JSONTokener.nextSimpleValue accumulates numeric characters into a StringBuilder with no length cap, then passes the full string to...

CVE-2026-59171

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application...

CVE-2026-59171

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application...

CVE-2026-59171

The JSON-java library (versions 20150729 through 20260522 ) is vulnerable to a resource exhaustion attack. The JSONTokener.nextSimpleValue method can accumulate unbounded numeric tokens, which are subsequently processed by JSONObject.stringToNumber for BigInteger or BigDecimal conversion without ...

CVE-2026-59171: stleary JSON-java: JSON-java is a reference implementation of a JSON package in Java

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application...

PT-2026-138424

Name of the Vulnerable Software and Affected Versions JSON-java versions 20150729 through 20260522 Description An issue exists where JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a...