CVE-2026-110974 in android-json
Summary
by MITRE • 10/23/2026
The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.
Users of the affected version should apply the following mitigation.
Product version com.vaadin.external.google:android-json 0.0.20131108.vaadin1
Mitigation No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.
Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the org.json parser within the com.vaadin.external.google:android-json library represents a critical failure in input validation and resource management, specifically categorized under CWE-675 as Use of Automatically Generated ID or CWE-400 Uncontrolled Resource Consumption. This artifact is essentially an unmaintained repackaging of third-party classes from 2013 that lacks modern security controls. The core technical flaw lies in the recursive implementation of the JSONTokener.nextValue() method, which delegates to readArray and readObject without implementing any mechanism to track or limit recursion depth. Consequently, when processing untrusted input containing deeply nested structures such as arrays within objects within arrays, the parser consumes stack space linearly with each level of nesting until the default thread stack size is exhausted.
This lack of a depth limit results in a java.lang.StackOverflowError rather than a controlled JSONException, which fundamentally alters the operational impact and remediation strategy for affected systems. In standard secure coding practices, parsers should catch such exceptions or enforce limits to allow graceful degradation or explicit error reporting. Instead, this vulnerability causes an abrupt termination of the thread executing the parsing operation. For applications that rely on continuous availability and process untrusted JSON data from external sources, this can lead to denial-of-service conditions where specific threads become unavailable, potentially causing cascading failures in multi-threaded environments if not properly isolated. The absence of a fixed version means that patching via library updates is impossible for the vulnerable artifact itself.
The recommended mitigation strategy requires immediate replacement of the com.vaadin.external.google:android-json dependency with a maintained alternative such as org.json:json version 20231013 or later, which includes safeguards against excessive nesting depths. This aligns with industry standards like OWASP Secure Coding Practices and NIST guidelines for input validation, emphasizing the need to validate not just data format but also structural complexity. By switching to a actively maintained library that enforces reasonable limits on JSON depth, organizations can prevent stack exhaustion attacks while maintaining compatibility with standard JSON parsing workflows. This change is critical for any system exposed to untrusted inputs, as it eliminates the attack vector entirely by ensuring that deeply nested payloads are rejected before they consume significant computational resources or crash application threads.