CVE-2026-59171

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.

• CWE-400
• CWE-770

• https://github.com/stleary/JSON-java/commit/703ac34a55400f9c50889e3d0c778b6d7962e81c
• https://github.com/stleary/JSON-java/commit/ab92bb9088a37f9e346cd1dda66f6a3c40a201e0
• https://github.com/stleary/JSON-java/commit/fce83c91bb229dde472283dea648a9a8955237fd
• https://github.com/stleary/JSON-java/pull/1065
• https://github.com/stleary/JSON-java/pull/1067
• https://github.com/stleary/JSON-java/releases/tag/20260719
• https://github.com/stleary/JSON-java/security/advisories/GHSA-ghc9-756g-vrcv

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59162Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-59163Mnemosyne is a memory layer for artificial intelligence agen…9.1
• CVE-2026-59164NORA is a self-hosted artifact registry and pull-through cac…7.1
• CVE-2026-59167SunEditor is a lightweight and powerful WYSIWYG editor in va…10
• CVE-2026-59168Dasel is a command-line tool and library for querying, modif…6.2
• CVE-2026-5917libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built w…8.8
• CVE-2026-59172Joker is a small Clojure interpreter, linter and formatter w…7.8
• CVE-2026-59173Uncontrolled Resource Consumption vulnerability in Apache Tr…7.5
• CVE-2026-59176Functype is a family of TypeScript functional programming li…7.8
• CVE-2026-59177ESPHome Device Builder Dashboard is a dashboard for the ESPH…8.8
• CVE-2026-59178ESPHome Device Builder Dashboard is a dashboard for the ESPH…9.8
• CVE-2026-59179OpenHop is a tool for creating interactive data-flow diagram…8.3