redhat/android-json vulnerabilities

Latest redhat/android-json CVEs

Newest publication first

1. CVE-2026-110974 Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

   Published 2026-10-22

   Medium·CVSS 6.3 EPSS 0.33%

   The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the defa...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.