AIKIDO-2026-424329
json is vulnerable to Denial of Service (DoS)
59
Medium Risk
This Affects:
jsonTL;DR
JSONTokener accumulates numeric characters from parsed JSON or XML into a string with no length limit and passes the full value to new BigInteger or new BigDecimal. A single request carrying a very large numeric literal can block the processing thread for seconds and exhaust the request thread pool. When untrusted input reaches JSONObject, JSONArray, or XML.toJSONObject, this causes uncontrolled resource consumption, and existing parser options such as strict mode and keep-strings do not prevent it. The fix adds a configurable maximum length that is enforced during parsing and during BigDecimal-to-BigInteger conversion before oversized values are materialized.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you parse untrusted input using JSONObject, JSONArray, or XML.toJSONObject.
Background info
json is vulnerable to Denial of Service (DoS) in versions 20070829 - 20260522.
How to fix this
Upgrade the org.json:json library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.