Input Validation Bypass in json-smart Affects Multiple Java Applications
CVE-2026-113602

6.9MEDIUM

Key Information:

Vendor

Json-smart

Status
Json-smart
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113602?

The json-smart library version 2.6.0 has a vulnerability that allows an evasion of strict-mode checks in JSON parsing. By introducing a literal 0x1A character into the input data, attackers can bypass strict validation mechanisms within methods like JSONValue.parseStrict and isValidJsonStrict. This manipulation results in inconsistent parsing outcomes when interacting with downstream parsers, such as Jackson or Gson. As a result, this vulnerability can lead to potential exploitation in applications relying on the json-smart library for JSON data processing.

Affected Version(s)

json-smart 0 <= 2.6.0

References

https://github.com/netplex/json-smart-v2/issues/302
issue-tracking
https://github.com/netplex/json-smart-v2/blob/v2.6.0/json...
technical-description
https://www.vulncheck.com/advisories/json-smart-through-2...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao, PayPal Cyber Security Team
.