EUVD-2026-41258
GHSA-q86x-4w7f-8hrm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated attacker sends untrusted JSON with no interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
1DescriptionCVE.org
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.
AnalysisAI
Denial of service in Eclipse Parsson before 1.1.8 lets remote unauthenticated attackers exhaust CPU and memory on any application that parses attacker-controlled JSON. Because the parser enforced no default cap on characters consumed per document, a single oversized payload - large arrays, strings, numbers, deep nesting, or whitespace - can hang or crash the service. No public exploit is identified at time of analysis; the fix (1.1.8) adds a configurable default limit of 15 million parser-consumed characters.
Technical ContextAI
Eclipse Parsson is the reference implementation of the Jakarta JSON Processing (JSON-P) API, formerly Glassfish JSON, and is embedded in many Jakarta EE runtimes and libraries that need standards-based JSON parsing. The root cause is CWE-400 (Uncontrolled Resource Consumption): the streaming/DOM parser read and buffered input for a single document without any upper bound on total characters processed, so worst-case inputs scale resource use linearly (or worse, for nested structures) with attacker-supplied document size. The CPE cpe:2.3:a:eclipse_foundation:eclipse_parsson:*:*:*:*:*:*:*:* covers all Maven Central artifact versions prior to 1.1.8. The 1.1.8 fix (PR #169, commit 134e8d1) introduces a configurable maximum on parser-consumed characters, defaulting to 15,000,000.
RemediationAI
Vendor-released patch: upgrade org.eclipse.parsson:parsson to 1.1.8 or later (https://repo.maven.apache.org/maven2/org/eclipse/parsson/parsson/1.1.8/), which introduces a configurable parsing limit defaulting to 15 million parser-consumed characters; review the Eclipse advisory at https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/444 and the fix in PR https://github.com/eclipse-ee4j/parsson/pull/169 (commit 134e8d101aa74c8b9302d0cb62f6ccb4912a9d0c). Because Parsson is usually a transitive dependency, check your full dependency tree and pin/override the version. If immediate upgrade is impossible, enforce an application- or gateway-level maximum request body size on any endpoint that parses JSON and apply timeouts and memory limits to parsing threads - the trade-off is that a size cap set too low can reject legitimate large payloads, so tune it to your real document sizes. After upgrading, you can further lower the configurable character limit below the 15M default to match expected input, accepting that overly strict limits will reject valid large documents.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today