Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.new Create a CVE report
Check your stack
CVE-2026-110974medium6.3

Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

Impact

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes,…

Source excerpt · Vaadin

What to do

No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.

Vaadin guidance

Exclude com.vaadin.external.google:android-json and depend on an org.json implementation that limits the nesting depth.

Vaadin guidance

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

vaadin · Vaadin

android-json

1 range
Vaadin version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

0 → through 0.0.20131108.vaadin1

maven versions

unaffected

unknown

Other versions: unaffected

Original source description

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.

Users of the affected version should apply the following mitigation.

Product version com.vaadin.external.google:android-json 0.0.20131108.vaadin1

Mitigation No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.

Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-110974

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-674 ↗

CWE-674 Uncontrolled Recursion

Vaadin

Related →
Contributing organizations · 2
Vaadin

Assigning organization

2026-10-22
CISA-ADP

Additional data publisher

2026-10-30

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

1 sources
repo.maven.apache.org/maven2/com/vaadin/external/google/android-json/0.0.20131108.vaadin1/
Source referenceVaadin