CVE-2026-59171

Name of the Vulnerable Software and Affected Versions JSON-java versions 20150729 through 20260522

Description An issue exists where JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. Applications parsing attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject may experience super-linear CPU consumption when converting excessively long numeric literals. This can block request-handling threads and lead to a denial of service. This behavior persists regardless of the strict mode and keep-strings settings in JSONParserConfiguration.

Recommendations Update JSON-java to version 20260719.