# CVE-2026-110974: Vaadin android-json stack overflow in JSON parsing

Source: https://junglewise.ai/threats/cve-2026-110974-the-org-json-parser-in-com-vaadin-external-google-android-json  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-110974 · Severity: info · Published 2026-10-22

Vaadin's android-json library, used to parse JSON data in applications, lacks depth limits on nested JSON structures. An attacker can supply a specially crafted deeply nested JSON document to cause the parsing thread to crash with a stack overflow, disrupting service availability for any application relying on this unmaintained library.

Vendors: [Vaadin](https://junglewise.ai/threats/vendors/vaadin).

## Quick answers

**Is CVE-2026-110974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110974 being exploited in the wild.

**How severe is CVE-2026-110974?** Informational severity, published 22 October 2026.

**Which products and versions are affected?** Vaadin Android-Json 0.0.20131108.vaadin1.

**Is there a fix for CVE-2026-110974?** No fixed version is recorded yet. No fixed version will be released. Replace com.vaadin.external.google:android-json with org.json:json version 20231013 or later, which implements nesting depth limits.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-110974 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110974?** Check whether you run Vaadin Android-Json at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


No fixed version will be released. Replace com.vaadin.external.google:android-json with org.json:json version 20231013 or later, which implements nesting depth limits.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22"}]

## Technical details

The JSONTokener.nextValue() method recurses once per JSON nesting level without enforcing a depth limit, causing a raw java.lang.StackOverflowError on deeply nested documents (~20 KB of nested arrays). The vulnerability affects the JSONArray and JSONObject constructors when parsing untrusted JSON input. This is a denial-of-service condition; no fixed version will be released for this unmaintained 2013 repackage.

## Affected products

- Vaadin android-json 0.0.20131108.vaadin1

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://repo.maven.apache.org/maven2/com/vaadin/external/google/android-json/0.0.20131108.vaadin1/](https://repo.maven.apache.org/maven2/com/vaadin/external/google/android-json/0.0.20131108.vaadin1/)