CVE-2026-110974: CWE-674 Uncontrolled Recursion in vaadin android-json
Description
The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released. Users of the affected version should apply the following mitigation. Product version com.vaadin.external.google:android-json 0.0.20131108.vaadin1 Mitigation No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none
CVSS v4.0
Score 6.3medium
Affected software
vaadin
android-json
pkg:maven/vaadin/com.vaadin.external.google:android-jsonRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in com.vaadin.external.google:android-json (version 0.0.20131108.vaadin1) is due to uncontrolled recursion in the JSONTokener.nextValue() method, which calls readArray() and readObject(), each recursively invoking nextValue() without depth limitation. This can cause a StackOverflowError when parsing deeply nested JSON documents (~20 KB or more). The artifact is a repackaged org.json library from 2013, unmaintained and with no planned fixes. Applications parsing untrusted JSON with this library risk thread crashes. The recommended mitigation is to replace this artifact with a maintained org.json implementation that limits nesting depth, such as org.json:json version 20231013 or later.
Potential Impact
Applications using the vulnerable android-json library to parse untrusted JSON can experience thread crashes due to StackOverflowError caused by deeply nested JSON input. This results in denial of service of the parsing thread. There is no indication of remote code execution or data corruption, but the failure disrupts normal application operation.
Mitigation Recommendations
No fixed version of com.vaadin.external.google:android-json will be released. Users should replace this artifact with a maintained org.json implementation that enforces nesting depth limits, for example org.json:json version 20231013 or later. This replacement prevents uncontrolled recursion and StackOverflowError when parsing deeply nested JSON.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Vaadin
- Date Reserved
- 2026-10-15T10:33:10.036Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad9d4514d27ba8daa426c83
Added to database: 10/22/2026, 09:16:01 UTC
Last enriched: 10/22/2026, 09:30:40 UTC
Last updated: 10/22/2026, 17:16:33 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.