CVE-2026-9563: Eclipse Parsson JSON Parser Denial-of-Service Vulnerability

Technical summary

CVE-2026-9563 is a resource exhaustion vulnerability (CWE-400, CWE-770) in Eclipse Parsson's JSON parser. The root cause is the absence of a default upper bound on parser input consumption. Vulnerable versions will attempt to parse arbitrarily large JSON documents without throttling, allowing an attacker-controlled input stream to exhaust heap memory and CPU cycles. The vulnerability is trivially triggered by network-reachable JSON endpoints. The fix in version 1.1.8 introduces a configurable character limit with a sensible default of 15 million characters per document, enabling organizations to tune the threshold based on legitimate use cases while blocking pathological inputs.

Business impact

For organizations deploying Eclipse Parsson in production services, this vulnerability enables remote denial-of-service attacks that require no authentication or user interaction. Web services, APIs, and message processors that accept JSON from untrusted sources become vectors for application crashes, service degradation, and resource starvation. The attack is low-effort for adversaries and can be weaponized by competitors, malicious users, or opportunistic attackers. Organizations may face unexpected outages, failed SLAs, and remediation costs if unpatched versions are in use.

Affected systems

Any application or library that depends on Eclipse Parsson versions prior to 1.1.8 is vulnerable. This includes direct usage of the Parsson library in Java applications, as well as transitive dependencies through other projects. Organizations should inventory Maven Central artifact downloads and check dependency trees for eclipse-parsson versions < 1.1.8, particularly in microservices, REST API gateways, message brokers, and data processing pipelines that ingest external JSON.

Exploitability

Exploitation is straightforward and requires only network access to a service that parses JSON from untrusted input. No authentication, user interaction, or privilege escalation is needed. Attackers can craft a valid JSON document of arbitrary size and submit it via HTTP, message queues, or other transport mechanisms. The attack surface is high for any organization running vulnerable code on the public internet. CVSS 3.1 score of 7.5 (High) reflects the low attack complexity and lack of authentication requirement, though the impact is limited to availability.

Remediation

Upgrade Eclipse Parsson to version 1.1.8 or later as soon as possible. This version introduces a configurable parsing limit with a sensible default. Organizations with custom parsing limits or unusual JSON document sizes should review the default limit of 15 million characters and adjust configuration if needed. For applications unable to patch immediately, implement network-level rate limiting, request size quotas, or input validation to reject oversized JSON payloads before they reach the parser.

Patch guidance

1. Update the eclipse-parsson dependency in your Maven pom.xml or Gradle build file to version 1.1.8 or later. 2. Run dependency analysis to identify all transitive consumers of the library. 3. Recompile and test affected services in a staging environment to ensure compatibility. 4. Review any custom parser configuration; the new default limit of 15 million characters should be appropriate for most use cases, but may require adjustment if your application processes exceptionally large JSON documents. 5. Deploy updates and monitor application logs for any parser limit exceptions during the transition.

Detection guidance

Monitor application logs and metrics for signs of resource exhaustion: sudden CPU spikes, memory pressure, or application hangs correlated with incoming requests. In Java applications using Parsson, enable debug logging on the JSON parser to detect parsing limit exceptions (if present in 1.1.8+). Network-level detection can include monitoring for unusually large HTTP requests with application/json content-type or abnormal message queue payloads. Behavioral anomalies such as repeated failed parsing events or gradual service degradation under sustained large-payload traffic are early warning signs of exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention because it is trivially exploitable, requires no privileges, and directly impacts service availability. While it does not enable data theft or code execution, denial-of-service attacks carry high business cost. The presence of Parsson in dependency chains is common in Java ecosystems, and the fix is straightforward and low-risk. Organizations should patch as part of emergency maintenance rather than waiting for the next release cycle.

Risk score, explained

CVE-2026-9563 scores 7.5 (High) under CVSS 3.1. The score reflects attack vector Network (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction (UI:N). The impact is limited to availability (A:H) with no confidentiality or integrity compromise (C:N, I:N). This accurately captures the ease of exploitation and the real but non-critical nature of the impact—services can be disrupted but not compromised. Organizations should treat this as urgent for internet-facing services and less critical for internal, trusted networks.

Frequently asked questions