redhat/json-smart vulnerabilities

Latest redhat/json-smart CVEs

Newest publication first

1. CVE-2026-113602 json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character

   Published 2026-10-20

   Medium·CVSS 6.9 EPSS 0.45%

   json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict val...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.