CVE-2026-9563: High severity Eclipse Parsson Parsson vulnerability
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse Parssonto a version that resolves this vulnerability.Fixed in 1.1.8 - Configuration
Configure Parsson’s maximum parsing limit to limit parser-consumed characters per JSON document (default is 15 million in version 1.1.8).
Eclipse Parsson maximum parsing limit (maximum parser-consumed characters) = 15 million parser-consumed characters
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9563?
The severity of CVE-2026-9563 is high with a score of 7.5.
How do I fix CVE-2026-9563?
To fix CVE-2026-9563, update Eclipse Parsson to version 1.1.8 or later.
What are the risks associated with CVE-2026-9563?
CVE-2026-9563 allows attacker-controlled JSON to consume excessive CPU and memory, leading to potential denial of service.
Which versions of Eclipse Parsson are affected by CVE-2026-9563?
CVE-2026-9563 affects all versions of Eclipse Parsson before 1.1.8.
What types of applications are vulnerable to CVE-2026-9563?
Applications that use the JSON parser in Eclipse Parsson prior to version 1.1.8 are vulnerable to CVE-2026-9563.