CVE-2026-110974— Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json
Quick assessment
Affected
vaadin android-json
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
中的 解析器在每一层嵌套时都会进行一次递归，且未设置深度限制： 方法会调用 和 ，而这两个方法又会再次调用 。对于深度嵌套的 JSON 文档（在默认线程栈大小下，约 20KB 的嵌套数组）， 和 的构造函数将抛出原始的 异常，而非预期的 。任何使用该库解析不可信 JSON 的应用程序，其执行解析操作的线程都可能因此失败。该构件是 2013 年对第三方 类的重新打包，仅发布过一次且从未维护，因此不会发布修复版本。 受影响版本的用户应采取以下缓解措施： 产品版本 0.0.20131108.vaadin1 缓解措施 不会
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110974
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json
Source: CVE Program / CVE List V5
Vulnerability Description
The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.
Users of the affected version should apply the following mitigation.
Product version
com.vaadin.external.google:android-json 0.0.20131108.vaadin1
Mitigation
No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.
Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| vaadin | android-json | 0 ~ 0.0.20131108.vaadin1 | - |
|
II. Public POCs for CVE-2026-110974
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110974
请登录查看更多情报信息。
Vendor Pages for CVE-2026-110974 (1)
IV. Related Vulnerabilities
Same vendor: vaadin
-
CVE-2026-110803
Session Lock Leak on an Invalid UI Id Allows Denial of Servi -
CVE-2026-107588
Multiple Vulnerabilities in the Highcharts Library Bundled w -
CVE-2026-93547
Missing Authorization Check in Vaadin Spreadsheet Allows Cel -
CVE-2026-91860
Prototype Pollution in Vaadin Charts and Component Base via -
CVE-2026-7860
Possible information disclosure of environment variables in
Same weakness: CWE-674
-
CVE-2026-66282
Authenticated Denial-of-Service in Zigbee Publish Billing Pe -
CVE-2026-82230
Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcp -
CVE-2026-54427
Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF -
CVE-2026-54426
Apache bRPC: Stack Exhaustion via Unbounded Recursion in Red -
CVE-2026-54425
Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Ta
V. Comments for CVE-2026-110974
No comments yet