org.json vulnerabilities

Products

• org.json/json 3

Latest org.json CVEs

Newest publication first

1. CVE-2026-59171 JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoS

   Published 2026-11-06

   Medium·CVSS 5.9

   JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limi...

2. CVE-2023-5072 DoS Vulnerability in JSON-Java

   Published 2023-10-12

   High·CVSS 7.5

   Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

3. CVE-2022-45688 json stack overflow vulnerability

   Published 2022-12-13

   High·CVSS 7.5

   A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.