Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-02T07:33:25 org.eclipse.parsson/parsson: Eclipse Parsson: Denial of Service via uncontrolled resource consumption in JSON parsing 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.

A flaw was found in Eclipse Parsson. The JSON parser did not enforce a default maximum on the number of characters consumed while processing a single JSON document. A remote attacker could exploit this by providing a very large, specially crafted JSON document. This could force applications to consume excessive CPU and memory, leading to a denial of service (DoS).

This is an Important denial of service vulnerability in Eclipse Parsson, a JSON processing library. Applications within Red Hat products that parse untrusted or attacker-controlled JSON documents are susceptible to excessive CPU and memory consumption. This can lead to resource exhaustion and service unavailability due to the parser not enforcing limits on the size or complexity of JSON input. Cryostat 4 Not affected parsson OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 Red Hat build of Apache Camel 4 for Quarkus 3 Not affected parsson Red Hat build of Apache Camel for Spring Boot 4 Not affected parsson Red Hat build of Apache Camel - HawtIO 4 Not affected parsson Red Hat build of Apicurio Registry 3 Affected parsson Red Hat build of Debezium 3 Affected parsson Red Hat Build of Keycloak Not affected parsson Red Hat Build of Keycloak Not affected rhbk/keycloak-rhel9 Red Hat Build of Keycloak Not affected rhbk/keycloak-rhel9-operator Red Hat Build of Keycloak Not affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Build of Keycloak Not affected rhbk-rhel9-operator/rhbk-rhel9-operator Red Hat build of Quarkus Not affected parsson Red Hat Data Grid 8 Affected parsson Red Hat JBoss Enterprise Application Platform 8 Not affected parsson Red Hat JBoss Enterprise Application Platform Expansion Pack Affected parsson Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift Dev Spaces Not affected devspaces/multicluster-redirector-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/pluginregistry-rhel9 streams for Apache Kafka 2 Affected parsson streams for Apache Kafka 3 Affected parsson https://www.cve.org/CVERecord?id=CVE-2026-9563 https://nvd.nist.gov/vuln/detail/CVE-2026-9563 https://github.com/eclipse-ee4j/parsson/commit/134e8d101aa74c8b9302d0cb62f6ccb4912a9d0c https://github.com/eclipse-ee4j/parsson/pull/169 https://github.com/eclipse-ee4j/parsson/tree/1.1.8 https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/444 https://repo.maven.apache.org/maven2/org/eclipse/parsson/parsson/1.1.8/