CVE-2026-9563 Details

A denial-of-service vulnerability has been identified in Eclipse Parsson versions prior to 1.1.8. The issue arises because the JSON parser does not impose a default maximum on the number of characters processed from a single JSON document. This lack of restriction allows applications to be manipulated into consuming excessive CPU and memory by parsing large JSON documents, including extensive arrays, objects, strings, numbers, whitespace, or nested structures. As a result, the application can experience an out-of-memory error, leading to a denial-of-service condition. This vulnerability is particularly concerning for applications that parse attacker-controlled JSON, especially those with public endpoints that accept 'application/json' content.

Users can upgrade to Eclipse Parsson version 1.1.8 or later, where this vulnerability has been addressed by introducing a configurable maximum parsing limit. The default limit in this version allows for 15 million characters to be parsed, which is sufficient for most use cases.