CVE-2026-110974: Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json
The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.
Users of the affected version should apply the following mitigation.
Product version com.vaadin.external.google:android-json 0.0.20131108.vaadin1
Mitigation No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.
Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
org.json:jsonto a version that resolves this vulnerability.Fixed in 20231013
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any application using com.vaadin.external.google:android-json 0.0.20131108.vaadin1 to parse untrusted JSON is exposed. A maliciously deeply nested JSON document can cause the parsing thread to fail with java.lang.StackOverflowError.
What does an attacker need to exploit it?
An attacker needs to supply JSON that the application passes to this library for parsing. The payload can be a deeply nested document; the description notes that roughly 20 KB of nested arrays can exhaust the default thread stack.
Is a patch available for the affected artifact?
No. The artifact was published once and is no longer maintained, and no fixed version will be released.
What should be done if this dependency is in use?
Replace com.vaadin.external.google:android-json with an org.json implementation that enforces a nesting-depth limit, such as org.json:json 20231013 or later.