Junglewise Threat Intelligence

CVE-2026-9563: Eclipse Parsson denial of service via uncontrolled JSON parsing

CVE-2026-9563 · Severity: high · CVSS 7.5 · Published 2026-07-02

Vendors: Eclipse Foundation.

Executive brief

Eclipse Parsson is a library used by Java applications to process JSON data. A vulnerability in versions before 1.1.8 allows an attacker to crash an application or make it unresponsive by sending a specially crafted, very large JSON document. This can lead to a denial of service, impacting the availability of web services that rely on this library to handle user input.

Technical details

Eclipse Parsson (before version 1.1.8) lacks a default maximum limit on the number of characters consumed during JSON parsing. This vulnerability (CWE-400, CWE-770) allows a remote, unauthenticated attacker to trigger an Out of Memory (OOM) error or excessive CPU usage by submitting large JSON documents containing deeply nested structures, large arrays, or long strings. The issue is particularly impactful for RESTful services using JSON Binding (JSON-B) that accept 'application/json' payloads. Version 1.1.8 fixes this by introducing a configurable 'maxParsingLimit' with a default value of 15 million characters.

Affected products

  • Eclipse Foundation Parsson 1.0.0 to 1.1.7

Timeline

  • 2026-05-25: patched: Fix merged into master branch
  • 2026-05-26: other: Version 1.1.8 published to Maven Central
  • 2026-07-02: disclosed: CVE-2026-9563 published

References