CVE-2026-110974

The com.vaadin.external.google:android-json library (version 0.0.20131108.vaadin1 ) is vulnerable to uncontrolled recursion due to a lack of depth limits in the org.json parser. Specifically, JSONTokener.nextValue() calls readArray() and readObject() , which recursively call nextValue() again. Pr...