CVE-2026-110974

A flaw was found in android-json. The parser lacks depth limits when processing nested structures such as arrays and objects. A remote attacker could exploit this vulnerability by submitting a crafted, deeply nested JSON payload to an application using the library, triggering uncontrolled recursi...

CVE-2026-110974 Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue calls readArray and readObject, which call nextValue again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes t...

CVE-2026-110974 Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue calls readArray and readObject, which call nextValue again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes t...

CVE-2026-110974

The com.vaadin.external.google:android-json library (version 0.0.20131108.vaadin1 ) is vulnerable to uncontrolled recursion due to a lack of depth limits in the org.json parser. Specifically, JSONTokener.nextValue() calls readArray() and readObject() , which recursively call nextValue() again. Pr...

Vaadin android-json resource management error vulnerability

Versions of Vaadin Android JSON prior to 0.0.20131108.1 contain a resource management error vulnerability. This vulnerability arises because the org.json parser lacks depth restrictions on nested structures; as a result, JSONTokener.nextValue recursively calls readArray and readObject. In cases o...