Executive brief
Eclipse Parsson is a library used by Java applications to process JSON data. A vulnerability in versions before 1.1.8 allows an attacker to crash an application or make it unresponsive by sending a specially crafted, very large JSON document. This can lead to a denial of service, impacting the availability of web services that rely on this library to handle user input.
Technical details
Eclipse Parsson (before version 1.1.8) lacks a default maximum limit on the number of characters consumed during JSON parsing. This vulnerability (CWE-400, CWE-770) allows a remote, unauthenticated attacker to trigger an Out of Memory (OOM) error or excessive CPU usage by submitting large JSON documents containing deeply nested structures, large arrays, or long strings. The issue is particularly impactful for RESTful services using JSON Binding (JSON-B) that accept 'application/json' payloads. Version 1.1.8 fixes this by introducing a configurable 'maxParsingLimit' with a default value of 15 million characters.
Affected products
- Eclipse Foundation Parsson 1.0.0 to 1.1.7
Timeline
- 2026-05-25: patched: Fix merged into master branch
- 2026-05-26: other: Version 1.1.8 published to Maven Central
- 2026-07-02: disclosed: CVE-2026-9563 published
References
- https://github.com/eclipse-ee4j/parsson/commit/134e8d101aa74c8b9302d0cb62f6ccb4912a9d0c
- https://github.com/eclipse-ee4j/parsson/pull/169
- https://github.com/eclipse-ee4j/parsson/tree/1.1.8
- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/444
- https://repo.maven.apache.org/maven2/org/eclipse/parsson/parsson/1.1.8/