CVE-2026-113602: json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character
json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.
Affected Software
Event History
Frequently Asked Questions
Which application flows are at practical risk?
Applications are at risk when they use JSONValue.parseStrict or isValidJsonStrict to validate input and then pass that same input to another JSON parser, such as Jackson or Gson. The bypass can create a parser differential between the strict-mode validation step and downstream processing.
What does an attacker need to include in a malicious payload?
The payload must contain a literal 0x1A character followed by malformed content. This can cause the json-smart strict-mode validation checks to accept input with trailing malformed data.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network attack access, low attack complexity, no privileges required, and no user interaction.
How can teams identify potentially affected code paths?
Review uses of JSONValue.parseStrict and isValidJsonStrict, particularly where validated input is subsequently parsed by Jackson, Gson, or another JSON parser. A relevant test case is input containing a literal 0x1A followed by malformed trailing content.