CoreCVE
Back

HIGH

org.eclipse.parsson/parsson: Eclipse Parsson: Denial of Service via uncontrolled resource consumption in JSON parsing

Published Jul 2, 2026

Description

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.

Affected products

Remediation

Red Hat statement

This is an Important denial of service vulnerability in Eclipse Parsson, a JSON processing library. Applications within Red Hat products that parse untrusted or attacker-controlled JSON documents are susceptible to excessive CPU and memory consumption. This can lead to resource exhaustion and service unavailability due to the parser not enforcing limits on the size or complexity of JSON input.

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner eclipse
Published Jul 2, 2026
Updated Jul 2, 2026
Reserved May 26, 2026
Link CVE-2026-9563
CISA Vulnrichment
Updated Jul 2, 2026
NVD
Status Deferred
Modified Jul 2, 2026
Link CVE-2026-9563
Red Hat
Severity Important
Public date Jul 2, 2026
Links CVE-2026-9563 - Bugzilla
ENISA EUVD
Assigner eclipse
Published Jul 2, 2026
Updated Jul 2, 2026
Exploited since n/a
Link EUVD-2026-41258
EUVD-2026-41258