CVE-2026-9563

Katalog CVE

CVSS 7.5 · High EPSS 0,63%

Kerentanan Uncontrolled Resource Consumption. Skor CVSS 3.1 7.5 (High) menurut eclipse.org.

Deskripsi (NVD)

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.

Rincian

Terbit di NVD

2 Juli 2026

Terakhir diubah

2 Juli 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber eclipse.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/eclipse-ee4j/parsson/commit/134e8d101aa74c8b9302d0cb62f6ccb4912a9d0c
• https://github.com/eclipse-ee4j/parsson/pull/169
• https://github.com/eclipse-ee4j/parsson/tree/1.1.8
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/444
• https://repo.maven.apache.org/maven2/org/eclipse/parsson/parsson/1.1.8/