CVE-2026-59171

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.

1. Executive Summary

JSON-java version 20260522 contains an unguarded path from an HTTP request body to unbounded BigInteger and BigDecimal construction. JSONTokener.nextSimpleValue() accumulates numeric characters into a StringBuilder with no length cap, then passes the full string to JSONObject.stringToNumber(), which calls new BigInteger(val) or new BigDecimal(val) directly. Both constructors have polynomial time complexity (O(n^1.585) for BigInteger).

A 488 KB JSON body — well within nginx's default 1 MB body-size limit — contains a 500,000-digit numeric literal that blocks the handling thread for approximately 3 seconds. Spring Boot has no default size limit for application/json request bodies. No parser configuration option (withStrictMode, withKeepStrings) prevents this. All three primary entry points are affected: new JSONObject(String), new JSONArray(String), and XML.toJSONObject(String).

This vulnerability is distinct from CVE-2023-5072 (which addressed StackOverflowError from deeply nested JSON structures via a try/catch in nextValue()) and from CVE-2022-45688 (which addressed recursive XML nesting depth). The numeric string length issue has been present since BigInteger support was introduced in release 20150729 and has never been fixed in any subsequent release.

Attack Complexity is rated High because successful exploitation requires the target application to be using org.json specifically (rather than the default Jackson library used by Spring Boot), and requires the developer to have explicitly passed user-controlled input to new JSONObject() or equivalent. These are deployment conditions beyond the attacker's control. See Section 6 for the full CVSS rationale and Section 8 for the comparison with Jackson's treatment of the same issue class.

This vulnerability was reproduced locally against json-20260522.jar with full evidence provided below.

2. Vulnerability Description

JSONTokener.nextSimpleValue() accumulates characters into a StringBuilder with no length limit until it hits a structural JSON character:

JSONTokener.java:500–504:

StringBuilder sb = new StringBuilder();
while (c >= ' ' && ",:]}/\\\"[{;=#".indexOf(c) < 0) {
    sb.append(c);     // unbounded — no length check
    c = this.next();
}

The accumulated string is passed to JSONObject.stringToValue() → stringToNumber(), which calls new BigInteger(val) with zero size guard:

JSONObject.java:2738:

BigInteger bi = new BigInteger(val);   // val can be arbitrarily large; no guard

BigInteger(String) has O(n^1.585) time complexity due to its internal Karatsuba multiplication during construction. A 100,000-digit input takes ~120 ms; a 1,000,000-digit input takes ~12 seconds. The decimal path (new BigDecimal(val), reached when the string contains a . or exponent) is equally affected.

No configuration option prevents this. withStrictMode(true) and withKeepStrings(true) are not checked in the nextSimpleValue() → stringToNumber() call chain. Confirmed by execution: both options still produce BigInteger in ~120 ms for a 100K-digit input.

Relationship to CVE-2023-5072: CVE-2023-5072 (fixed in release 20231013) catches StackOverflowError thrown by deeply nested JSON structures ({[ brackets) inside nextValue():

} catch (StackOverflowError e) {
    throw new JSONException("JSON Array or Object depth too large to process.", e);
}

This fix is in nextValue() and covers only recursive object/array structure depth. It has no effect on the numeric string length path in nextSimpleValue() → stringToNumber(). The BigInteger length issue was not addressed in 20231013 or in any subsequent release.

3. Affected Code Locations

| File | Lines | Description | |------|-------|-------------| | JSONTokener.java | 500–504 | nextSimpleValue() — unbounded character accumulation into…

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric literal, blocking request-handling threads and causing denial of service. Strict mode and keep-strings settings in JSONParserConfiguration do not prevent the affected conversion path. Version 20260719 limits numeric conversion length.

1. Executive Summary

JSON-java version 20260522 contains an unguarded path from an HTTP request body to unbounded BigInteger and BigDecimal construction. JSONTokener.nextSimpleValue() accumulates numeric characters into a StringBuilder with no length cap, then passes the full string to JSONObject.stringToNumber(), which calls new BigInteger(val) or new BigDecimal(val) directly. Both constructors have polynomial time complexity (O(n^1.585) for BigInteger).

A 488 KB JSON body — well within nginx's default 1 MB body-size limit — contains a 500,000-digit numeric literal that blocks the handling thread for approximately 3 seconds. Spring Boot has no default size limit for application/json request bodies. No parser configuration option (withStrictMode, withKeepStrings) prevents this. All three primary entry points are affected: new JSONObject(String), new JSONArray(String), and XML.toJSONObject(String).

This vulnerability is distinct from CVE-2023-5072 (which addressed StackOverflowError from deeply nested JSON structures via a try/catch in nextValue()) and from CVE-2022-45688 (which addressed recursive XML nesting depth). The numeric string length issue has been present since BigInteger support was introduced in release 20150729 and has never been fixed in any subsequent release.

Attack Complexity is rated High because successful exploitation requires the target application to be using org.json specifically (rather than the default Jackson library used by Spring Boot), and requires the developer to have explicitly passed user-controlled input to new JSONObject() or equivalent. These are deployment conditions beyond the attacker's control. See Section 6 for the full CVSS rationale and Section 8 for the comparison with Jackson's treatment of the same issue class.

This vulnerability was reproduced locally against json-20260522.jar with full evidence provided below.

2. Vulnerability Description

JSONTokener.nextSimpleValue() accumulates characters into a StringBuilder with no length limit until it hits a structural JSON character:

JSONTokener.java:500–504:

StringBuilder sb = new StringBuilder();
while (c >= ' ' && ",:]}/\\\"[{;=#".indexOf(c) < 0) {
    sb.append(c);     // unbounded — no length check
    c = this.next();
}

The accumulated string is passed to JSONObject.stringToValue() → stringToNumber(), which calls new BigInteger(val) with zero size guard:

JSONObject.java:2738:

BigInteger bi = new BigInteger(val);   // val can be arbitrarily large; no guard

BigInteger(String) has O(n^1.585) time complexity due to its internal Karatsuba multiplication during construction. A 100,000-digit input takes ~120 ms; a 1,000,000-digit input takes ~12 seconds. The decimal path (new BigDecimal(val), reached when the string contains a . or exponent) is equally affected.

No configuration option prevents this. withStrictMode(true) and withKeepStrings(true) are not checked in the nextSimpleValue() → stringToNumber() call chain. Confirmed by execution: both options still produce BigInteger in ~120 ms for a 100K-digit input.

Relationship to CVE-2023-5072: CVE-2023-5072 (fixed in release 20231013) catches StackOverflowError thrown by deeply nested JSON structures ({[ brackets) inside nextValue():

} catch (StackOverflowError e) {
    throw new JSONException("JSON Array or Object depth too large to process.", e);
}

This fix is in nextValue() and covers only recursive object/array structure depth. It has no effect on the numeric string length path in nextSimpleValue() → stringToNumber(). The BigInteger length issue was not addressed in 20231013 or in any subsequent release.

3. Affected Code Locations

| File | Lines | Description | |------|-------|-------------| | JSONTokener.java | 500–504 | nextSimpleValue() — unbounded character accumulation into…

These are all security issues fixed in the json-java-20260814-1.1 package on the GA media of openSUSE Tumbleweed.