CVE-2026-110974 vaadin CVE debrief

Who should care

Defenders and developers who work with JSON parsing in applications using the affected com.vaadin.external.google:android-json library should assess exposure and prioritize mitigation.

Why it matters

Defenders should care about CVE-2026-110974 because it allows for denial-of-service attacks through deeply nested JSON documents, potentially causing thread failures in applications that parse untrusted JSON with the affected library. The vulnerability requires verification of affected versions, inventory checks, and prioritized remediation.

• Thread failures due to StackOverflowError
• Potential denial-of-service attacks through deeply nested JSON documents
• Need for verification of affected versions and inventory checks
• Remediation priority for applications parsing untrusted JSON

Technical summary

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit, causing a StackOverflowError when parsing deeply nested JSON documents. The vulnerability is caused by the recursive nature of JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again without a depth limit. This can lead to thread failures in applications that parse untrusted JSON with the affected library. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in applications that parse untrusted JSON with this library, as it can cause thread failures.

Recommended defensive actions

• Verify and inventory applications that use the affected com.vaadin.external.google:android-json library.
• Mitigate the vulnerability by replacing the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.
• Monitor and restrict the parsing of untrusted JSON in applications.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the recursive nature of JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again without a depth limit, leading to a StackOverflowError. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released. Users of the affected version should apply the following mitigation. The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.