CVE-2026-110974

The com.vaadin.external.google:android-json library (version 0.0.20131108.vaadin1 ) is vulnerable to uncontrolled recursion due to a lack of depth limits in the org.json parser. Specifically, JSONTokener.nextValue() calls readArray() and readObject() , which recursively call nextValue() again. Pr...

CVE-2026-110974 Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue calls readArray and readObject, which call nextValue again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes t...