---
id: CVE-2026-110974
title: Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json
summary: >-
  The org.json parser in com.vaadin.external.google:android-json recurses once
  per nesting level with no depth limit: JSONTokener.nextValue() calls
  readArray() and readObject(), which call nextValue() again. A deeply nested
  JSON document, …
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-674
vendor: vaadin
product: 'com.vaadin.external.google:android-json'
affected:
  - 'com.vaadin.external.google:android-json <= 0.0.20131108.vaadin1'
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T08:52:27.149Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110974'
references:
  - url: >-
      https://repo.maven.apache.org/maven2/com/vaadin/external/google/android-json/0.0.20131108.vaadin1/
tags:
  - cve.org
ingestedAt: '2026-10-22T09:34:48.704Z'
---

## Overview

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released.


Users of the affected version should apply the following mitigation.

Product version
com.vaadin.external.google:android-json 0.0.20131108.vaadin1

Mitigation
No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.

Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none

## Affected

- `com.vaadin.external.google:android-json <= 0.0.20131108.vaadin1`

## Remediation

No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later.

### Workarounds

Exclude com.vaadin.external.google:android-json and depend on an org.json implementation that limits the nesting depth.