Is CVE-2026-59171 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59171 being exploited in the wild.

How severe is CVE-2026-59171?

Medium severity, with a CVSS score of 5.9, published 6 November 2026.

Which products and versions are affected?

org.json:json (Maven) >= 20150729, < 20260719, ECOSYSTEM:introduced=20150729,fixed=20260719; Stleary JSON-java 20150729 through 20260522.

Is there a fix for CVE-2026-59171?

Yes. org.json:json (Maven): upgrade to 20260719 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59171 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59171?

Check whether you run org.json:json (Maven) or Stleary JSON-java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59171: JSON-java ReDoS in numeric token conversion

Q: Is there a fix for CVE-2026-59171?

Yes. org.json:json (Maven): upgrade to 20260719 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59171 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59171?

Check whether you run org.json:json (Maven) or Stleary JSON-java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59171 · Severity: medium · CVSS 5.9 · Published 2026-11-06

JSON-java is a widely-used Java library for parsing JSON and XML data. When processing JSON or XML containing very long numeric values, the library can consume excessive CPU time during number conversion, allowing an attacker to cause denial of service by blocking application threads and slowing down or stopping request handling.

Technologies: org.json:json (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-59171 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59171 being exploited in the wild.
How severe is CVE-2026-59171?: Medium severity, with a CVSS score of 5.9, published 6 November 2026.
Which products and versions are affected?: org.json:json (Maven) >= 20150729, < 20260719, ECOSYSTEM:introduced=20150729,fixed=20260719; Stleary JSON-java 20150729 through 20260522.
Is there a fix for CVE-2026-59171?: Yes. org.json:json (Maven): upgrade to 20260719 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59171 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59171?: Check whether you run org.json:json (Maven) or Stleary JSON-java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.json:json (Maven): upgrade to 20260719 or later

# set org.json:json to 20260719 in your pom.xml or build.gradle

Technical details

JSONTokener.nextSimpleValue accumulates unbounded numeric tokens that are later converted by JSONObject.stringToNumber without length validation, passing them directly to BigInteger or BigDecimal. An attacker can craft JSON or XML with sufficiently long numeric literals to cause super-linear CPU consumption; both strict mode and keep-strings settings in JSONParserConfiguration are bypassed. Version 20260719 introduces a 1000-character length limit to prevent this conversion path.

Affected products

stleary JSON-java 20150729 through 20260522

Identifiers

CVE-2026-59171
GHSA-ghc9-756g-vrcv

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.