Denial of Service Vulnerability in JSON-java Library
CVE-2026-59171

5.9MEDIUM

Key Information:

Vendor

Stleary

Status
Json-java
Vendor
CVE Published:
6 November 2026

What is CVE-2026-59171?

The JSON-java library is vulnerable to a denial of service attack due to unbounded numeric token accumulation in the JSONTokener.nextSimpleValue method. This issue affects applications that parse attacker-controlled JSON or XML, potentially overwhelming the system's CPU resources and blocking request handling. The vulnerability persists despite strict mode configurations, making it imperative for users to upgrade to version 20260719 or later, which introduces limits on numeric conversion lengths to mitigate the risk.

Affected Version(s)

JSON-java >= 20150729, < 20260719

References

https://github.com/stleary/JSON-java/security/advisories/...
x_refsource_CONFIRM
https://github.com/stleary/JSON-java/pull/1065
x_refsource_MISC
https://github.com/stleary/JSON-java/pull/1067
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.