CVE-2026-37736 in json-sanitizer
Summary
by MITRE • 08/28/2026
An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within the OWASP JSON Sanitizer library version 1.2.3 represents a significant reliability risk for applications relying on this component for data validation and sanitization prior to processing or storage. The core issue resides in the JsonSanitizer.sanitize() method, which is designed to clean incoming JSON payloads by removing potentially dangerous characters or structures that could lead to injection attacks or other security breaches. However, under specific conditions involving crafted input strings, the internal logic of this sanitizer fails to handle certain edge cases efficiently, leading to excessive resource consumption rather than proper rejection or sanitization of the malicious payload. This flaw is not a direct code execution vulnerability but rather an algorithmic inefficiency that can be exploited remotely by attackers who have control over the input data stream.
From a technical perspective, this issue aligns with CWE-400, which describes Uncontrolled Resource Consumption, and more specifically points toward mechanisms that allow for Denial of Service through resource exhaustion. The vulnerability likely stems from an infinite loop or exponential time complexity within the sanitization logic when processing deeply nested structures or specific character sequences that trigger recursive backtracking without proper bounds checking. When a crafted input is submitted to the sanitize function, it forces the application thread to consume disproportionate amounts of CPU cycles and memory as it attempts to process the malformed data structure. This behavior effectively stalls the execution flow for the duration of the processing time, preventing the server from handling other legitimate requests during that window.
The operational impact of this vulnerability is primarily centered on service availability rather than confidentiality or integrity in the traditional sense. An attacker can exploit this flaw by sending a series of carefully constructed HTTP POST requests containing malicious JSON payloads to any endpoint that utilizes the OWASP json-sanitizer library for input validation. The resulting Denial of Service condition manifests as increased latency, thread pool exhaustion, and potentially complete unavailability of the affected service if the application does not implement adequate timeout mechanisms or rate limiting at a higher architectural layer. For high-traffic web applications, this can lead to cascading failures where other services dependent on the compromised component also experience degradation due to shared resource constraints such as memory pressure or connection pool saturation.
Mitigation strategies for this vulnerability require both immediate patching and long-term defensive design practices. The most effective remediation is to upgrade the OWASP json-sanitizer library to a version later than 1.2.3 where this specific logic flaw has been addressed by the maintainers through algorithmic optimization or stricter input validation rules that prevent pathological cases from triggering resource exhaustion. In environments where upgrading is not immediately feasible, developers should implement strict rate limiting and request size restrictions at the web server or API gateway level to limit the volume of requests processed by the sanitizer. Additionally, introducing timeouts for long-running operations within the application code can help mitigate the impact by terminating threads that exceed a predefined execution duration, thereby preserving system stability even if malicious inputs are received.
This vulnerability also relates to ATT&CK technique T1499, Endpoint Denial of Service, as it involves leveraging software vulnerabilities to disrupt service availability. Security teams should monitor for unusual spikes in CPU usage or memory consumption associated with JSON parsing endpoints and review logs for patterns indicative of repeated failed sanitization attempts. By addressing this issue through timely updates and robust input handling policies, organizations can maintain the integrity and availability of their web services against exploitation via resource exhaustion attacks targeting third-party libraries.