AIKIDO-2026-424329

TL;DR

JSONTokener accumulates numeric characters from parsed JSON or XML into a string with no length limit and passes the full value to new BigInteger or new BigDecimal. A single request carrying a very large numeric literal can block the processing thread for seconds and exhaust the request thread pool. When untrusted input reaches JSONObject, JSONArray, or XML.toJSONObject, this causes uncontrolled resource consumption, and existing parser options such as strict mode and keep-strings do not prevent it. The fix adds a configurable maximum length that is enforced during parsing and during BigDecimal-to-BigInteger conversion before oversized values are materialized.