Is CVE-2026-110974 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110974 being exploited in the wild.

How severe is CVE-2026-110974?

Informational severity, published 22 October 2026.

Which products and versions are affected?

Vaadin Android-Json 0.0.20131108.vaadin1.

Is there a fix for CVE-2026-110974?

No fixed version is recorded yet. No fixed version will be released. Replace com.vaadin.external.google:android-json with org.json:json version 20231013 or later, which implements nesting depth limits. [{"kind":"disclosed","at":"2026-10-22"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-110974 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110974?

Check whether you run Vaadin Android-Json at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110974: Vaadin android-json stack overflow in JSON parsing

CVE-2026-110974 · Severity: info · Published 2026-10-22

Vaadin's android-json library, used to parse JSON data in applications, lacks depth limits on nested JSON structures. An attacker can supply a specially crafted deeply nested JSON document to cause the parsing thread to crash with a stack overflow, disrupting service availability for any application relying on this unmaintained library.

Vendors: Vaadin.

Quick answers

Is CVE-2026-110974 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110974 being exploited in the wild.
How severe is CVE-2026-110974?: Informational severity, published 22 October 2026.
Which products and versions are affected?: Vaadin Android-Json 0.0.20131108.vaadin1.
Is there a fix for CVE-2026-110974?: No fixed version is recorded yet. No fixed version will be released. Replace com.vaadin.external.google:android-json with org.json:json version 20231013 or later, which implements nesting depth limits.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-110974 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110974?: Check whether you run Vaadin Android-Json at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

No fixed version will be released. Replace com.vaadin.external.google:android-json with org.json:json version 20231013 or later, which implements nesting depth limits.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22"}]

Technical details

The JSONTokener.nextValue() method recurses once per JSON nesting level without enforcing a depth limit, causing a raw java.lang.StackOverflowError on deeply nested documents (~20 KB of nested arrays). The vulnerability affects the JSONArray and JSONObject constructors when parsing untrusted JSON input. This is a denial-of-service condition; no fixed version will be released for this unmaintained 2013 repackage.

Affected products

Vaadin android-json 0.0.20131108.vaadin1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.