com.vaadin.external.google:android-json vulnerabilities

CVEs whose affected-version data names the com.vaadin.external.google:android-json package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110974Medium· 6.3

today

Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, …

▾ Sunlitvaadin · com.vaadin.external.google:android-jsonvia CVEORG