Vaadin android-json CVE-2026-110974

The application must parse attacker-controlled (untrusted) JSON using com.vaadin.external.google:android-json 0.0.20131108.vaadin1, and the parsing thread must run with the default (limited) stack size - the advisory states roughly 20 KB of nested arrays suffices under the default thread stack. The flaw is that the JSONArray/JSONObject constructors throw a raw java.lang.StackOverflowError rather than a JSONException, so ordinary try/catch(JSONException) handling does not contain it. Limiting factors: no authentication is required (PR:N) and the trigger is simple (AC:L), but reachability depends on the application actually exposing an untrusted-JSON parse path through this specific artifact; impact is bounded to availability of the parsing thread (VA:L, no confidentiality/integrity effect), and larger thread stacks raise the nesting depth required.

This is a denial-of-service via unbounded recursion (CWE-674): parsing a deeply nested JSON document (~20 KB of nested arrays with the default thread stack) makes JSONTokener.nextValue()/readArray()/readObject() recurse until the JSONArray/JSONObject constructor throws a raw java.lang.StackOverflowError instead of a catchable JSONException, killing the thread doing the parse. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 and confines impact to availability only (VC:N/VI:N/VA:L, SC/SI/SA:N) - no confidentiality, integrity, or code execution. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input; by the precision rule this is 'no public exploit identified at time of analysis.' The vuln.today decision label is this_month - a near-term patch priority, not act_now/emergency. Realistically this is a moderate, not critical, issue: the technical ceiling is a crashed parsing thread, and exploitation is only reachable where the application feeds untrusted JSON through this specific library. The AT:P flag reflects a genuine dependency on the (default, limited) thread stack size rather than attacker-uncontrolled timing - the trigger itself (send nested JSON) is simple and attacker-controlled. The most significant operational fact is that no fix will ever ship: the artifact is a 2013 repackage published once and never maintained, so remediation is replacement, not patching.

An application exposes an endpoint or message path that parses attacker-supplied JSON using com.vaadin.external.google:android-json. The attacker submits a ~20 KB document of deeply nested arrays; the recursive parser exhausts the thread's stack and throws an uncaught StackOverflowError, failing the parsing thread. No public exploit code is identified in the input, though the trigger is trivial to construct.