CVE-2026-9563 describes an uncontrolled resource consumption vulnerability (CWE-400) in Eclipse Parsson JSON parser versions prior to 1.1.8. The parser lacks a default maximum limit on characters consumed while parsing a single JSON document. Attackers can exploit this by sending large or deeply nested JSON inputs, causing excessive CPU and memory usage and resulting in denial of service. Eclipse Parsson 1.1.8 addresses this by adding a configurable maximum parsing limit with a default of 15 million characters.

The vulnerability allows denial of service through resource exhaustion (high impact on availability). There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.

Upgrade to Eclipse Parsson version 1.1.8 or later, which introduces a configurable maximum parsing limit to prevent excessive resource consumption. Patch status is not explicitly confirmed in the advisory, but the fixed version is 1.1.8. Until upgraded, avoid parsing untrusted or attacker-controlled JSON inputs or implement external input size restrictions.