{"id":"CVE-2026-110974","aliases":[],"cve":{"records":[{"id":"CVE-2026-110974","source":"Vaadin","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-15T10:33:10.036Z","published":"2026-10-22T08:52:27.149Z","modified":"2026-10-30T18:07:46.612Z"}],"publishers":[{"name":"Vaadin","role":"CNA","organizationId":"9e0f3122-90e9-42d5-93de-8c6b98deef7e","modified":"2026-10-22T08:52:27.149Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T18:07:46.612Z"}],"references":[{"url":"https://repo.maven.apache.org/maven2/com/vaadin/external/google/android-json/0.0.20131108.vaadin1/","tags":[],"source":"Vaadin"}],"weaknesses":[{"id":"CWE-674","description":"CWE-674 Uncontrolled Recursion","source":"Vaadin"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T18:07:33.060957Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json","titleSource":"Vaadin","descriptionSource":"Vaadin","description":"The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.\n\n\nUsers of the affected version should apply the following mitigation.\n\nProduct version\ncom.vaadin.external.google:android-json 0.0.20131108.vaadin1\n\nMitigation\nNo fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.\n\nArtifacts\nMaven coordinates / Vulnerable versions / Fixed version\ncom.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none","score":6.3,"severity":"medium","published":"2026-10-22T08:52:27.149Z","modified":"2026-10-30T18:07:46.612Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"vaadin","name":"android-json","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.0.20131108.vaadin1","versionType":"maven"}],"defaultStatus":"unaffected","cpes":[],"source":"Vaadin","url":"https://www.cve.org/CVERecord?id=CVE-2026-110974"}],"remediation":[{"text":"No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.","source":"Vaadin","url":"https://www.cve.org/CVERecord?id=CVE-2026-110974"},{"text":"Exclude com.vaadin.external.google:android-json and depend on an org.json implementation that limits the nesting depth.","source":"Vaadin","url":"https://www.cve.org/CVERecord?id=CVE-2026-110974"}],"references":["https://repo.maven.apache.org/maven2/com/vaadin/external/google/android-json/0.0.20131108.vaadin1/"],"sources":[{"name":"CVE","id":"CVE-2026-110974","modified":"2026-10-30T18:07:46.612Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-110974"}],"assessments":[{"source":"Vaadin","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3}],"sourceAffected":[],"observedAt":"2026-10-30T19:12:42.469Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T07:45:30.596Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}