Stack Overflow Risk in JSON Parser from Vaadin's Android JSON Library

CVE-2026-110974

What is CVE-2026-110974?

The JSON parser provided by Vaadin's android-json library poses a significant risk due to its lack of a depth limit in recursion during parsing. This can lead to a StackOverflowError when handling deeply nested JSON documents, causing applications that rely on this library to crash when parsing untrusted JSON data. The affected version, 0.0.20131108.vaadin1, has not been maintained since its release in 2013, and as such, no fixed version is available. Users are strongly advised to replace this artifact with an alternative JSON implementation that enforces a nesting depth limit, thereby mitigating the risk of thread failure during JSON parsing.

References