CVE-2026-59171
JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoS
Description
JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.
INFO
Published Date :
Nov. 6, 2026, 8:12 p.m.
Last Modified :
Nov. 6, 2026, 8:12 p.m.
Remotely Exploit :
No
Source :
GitHub_M
Solution
- Update JSON-java to version 20260719 or later.
- Monitor for excessive CPU usage during JSON parsing.
- Implement input validation for numeric tokens if updating is not possible.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-59171 vulnerability anywhere in the article.