# CVE-2026-59171: JSON-java ReDoS in numeric token conversion

Source: https://junglewise.ai/threats/cve-2026-59171-json-java-is-a-reference-implementation-of-a-json-package-in-java  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-59171 · Severity: medium · CVSS 5.9 · Published 2026-11-06

JSON-java is a widely-used Java library for parsing JSON and XML data. When processing JSON or XML containing very long numeric values, the library can consume excessive CPU time during number conversion, allowing an attacker to cause denial of service by blocking application threads and slowing down or stopping request handling.

Technologies: [org.json:json (Maven)](https://junglewise.ai/threats/technologies/org-json-json). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-59171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59171 being exploited in the wild.

**How severe is CVE-2026-59171?** Medium severity, with a CVSS score of 5.9, published 6 November 2026.

**Which products and versions are affected?** org.json:json (Maven) >= 20150729, < 20260719, ECOSYSTEM:introduced=20150729,fixed=20260719; Stleary JSON-java 20150729 through 20260522.

**Is there a fix for CVE-2026-59171?** Yes. org.json:json (Maven): upgrade to 20260719 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59171 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59171?** Check whether you run org.json:json (Maven) or Stleary JSON-java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.json:json (Maven): upgrade to 20260719 or later

  ```sh
  # set org.json:json to 20260719 in your pom.xml or build.gradle
  ```


## Technical details

JSONTokener.nextSimpleValue accumulates unbounded numeric tokens that are later converted by JSONObject.stringToNumber without length validation, passing them directly to BigInteger or BigDecimal. An attacker can craft JSON or XML with sufficiently long numeric literals to cause super-linear CPU consumption; both strict mode and keep-strings settings in JSONParserConfiguration are bypassed. Version 20260719 introduces a 1000-character length limit to prevent this conversion path.

## Affected products

- stleary JSON-java 20150729 through 20260522

## Identifiers

- CVE-2026-59171
- GHSA-ghc9-756g-vrcv

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/stleary/JSON-java/commit/703ac34a55400f9c50889e3d0c778b6d7962e81c](https://github.com/stleary/JSON-java/commit/703ac34a55400f9c50889e3d0c778b6d7962e81c)
- [https://github.com/stleary/JSON-java/commit/ab92bb9088a37f9e346cd1dda66f6a3c40a201e0](https://github.com/stleary/JSON-java/commit/ab92bb9088a37f9e346cd1dda66f6a3c40a201e0)

## Related threats

- [Java: DoS Vulnerability in JSON-JAVA](https://junglewise.ai/threats/cve-2023-5072-java-dos-vulnerability-in-json-java)
- [Duplicate Advisory: Denial of Service in JSON-Java](https://junglewise.ai/threats/duplicate-advisory-denial-of-service-in-json-java-0f5ab6d1)
- [json stack overflow vulnerability](https://junglewise.ai/threats/cve-2022-45688-json-stack-overflow-vulnerability)