JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2026-59171: 0.55% estimated exploitation activity in the next 30 days; percentile 46.49 (FIRST EPSS, 2026-11-10). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

1. Executive Summary JSON-java version 20260522 contains an unguarded path from an HTTP request body to unbounded `BigInteger` and `BigDecimal` construction. `JSONTokener.nextSimpleValue()` accumulates numeric characters into a `StringBuilder` with no length cap, then passes the full string to `JSONObject.stringToNumber()`, which calls `new BigInteger(val)` or `new BigDecimal(val)` directly. Both constructors have polynomial time complexity (O(n^1.585) for `BigInteger`). A 488 KB JSON body — well within nginx's default 1 MB body-size limit — contains a 500,000-digit numeric literal that blocks the handling thread for approximately 3 seconds. Spring Boot has no default size limit for `application/json` request bodies. No parser configuration option (`withStrictMode`, `withKeepStrings`) prevents this. All three primary entry points are affected: `new JSONObject(String)`, `new JSONArray(String)`, and `XML.toJSONObject(String)`. This vulnerability is distinct from CVE-2023-5072 (which…

Published by the source

9 Nov 2026, 21:12 UTC

Last modified by the source

9 Nov 2026, 21:30 UTC

Source last checked

10 Nov 2026, 06:45 UTC

1. Revision 2 · amended · 10 Nov 2026

   Amended from osv record GHSA-ghc9-756g-vrcv

2. Revision 1 · created · 9 Nov 2026

   Published from ghsa record GHSA-ghc9-756g-vrcv

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-59171

Advisory: JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS
IDs: CVE-2026-59171, GHSA-ghc9-756g-vrcv
Record: https://patchnext.com/advisories/cve-2026-59171 (revision 2, source checked 10 Nov 2026, 06:45 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.9)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: org.json:json 20260719. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven org.json:json: affected >= 20150729, < 20260719; fixed in 20260719

## Suggested inspection (read-only)
- Maven org.json:json: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on org.json:json.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-ghc9-756g-vrcv (GitHub-reviewed advisory GHSA-ghc9-756g-vrcv lists affected ranges: Maven org.json:json >=20150729 <20260719)
- Verified: https://osv.dev/vulnerability/GHSA-ghc9-756g-vrcv (OSV record GHSA-ghc9-756g-vrcv lists affected ranges: Maven org.json:json >=20150729 <20260719 (fixed))

Commands are suggestions: review each one before running it.