CVE-2026-37736: OWASP json-sanitizer DoS Vulnerability

CVE-2026-37736 Overview

CVE-2026-37736 is a denial of service vulnerability in the OWASP json-sanitizer library version 1.2.3. The flaw resides in the JsonSanitizer.sanitize() component, which fails to properly bound resource consumption when processing crafted input. Attackers can submit malicious JSON payloads over the network to trigger excessive resource use, rendering applications unresponsive. The weakness is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). Because json-sanitizer is embedded in many Java web applications and services that accept untrusted JSON, the impact extends across any downstream software incorporating the affected version.

Critical Impact
Remote unauthenticated attackers can trigger denial of service against any application that passes untrusted input to JsonSanitizer.sanitize() in OWASP json-sanitizer v1.2.3.

Affected Products

OWASP json-sanitizer v1.2.3
Java applications embedding the affected library
Web services and APIs performing JSON sanitization with the vulnerable release

Discovery Timeline

2026-08-28 - CVE-2026-37736 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-37736

Vulnerability Analysis

The defect lies in JsonSanitizer.sanitize(), the entry point OWASP json-sanitizer exposes for cleaning untrusted JSON before consumption by strict parsers. The routine does not enforce upper bounds on processing time or resource allocation when it encounters certain crafted structures. An attacker who supplies malformed or pathologically nested JSON can force the sanitizer into prolonged execution or excessive memory use. The process hosting the library becomes unable to service legitimate requests during the attack window. Because sanitization typically runs early in request handling, a single malicious payload can stall an entire request-processing thread.

Root Cause

The root cause is missing input throttling in the sanitization state machine, aligning with CWE-770. The library accepts arbitrary input size and structural complexity without applying depth, length, or time limits. Details of the specific parsing paths that amplify complexity are tracked in the GitHub Issue #35 for JSON Sanitizer.

Attack Vector

Exploitation requires only network reachability to an endpoint that forwards user-controlled JSON into JsonSanitizer.sanitize(). No authentication, elevated privileges, or user interaction are required. Attackers can send the crafted payload through any HTTP handler, message queue consumer, or API gateway that invokes the library. Repeated submissions amplify the impact and can exhaust thread pools, connection pools, or JVM heap. Reference source is available at the OWASP json-sanitizer GitHub repository.

No verified public exploit code is available. Technical details are described in the referenced GitHub issue.

Detection Methods for CVE-2026-37736

Indicators of Compromise

Sustained high CPU utilization on Java processes invoking JsonSanitizer.sanitize() shortly after receiving JSON requests.
Thread dumps showing multiple worker threads blocked inside json-sanitizer stack frames.
Elevated request latency or timeouts on endpoints that ingest JSON from untrusted sources.
HTTP 5xx or connection reset spikes correlated with anomalously large or deeply nested JSON payloads.

Detection Strategies

Enable JVM Flight Recorder or async-profiler to identify hotspots inside com.google.json.JsonSanitizer.
Inspect ingress logs for JSON bodies exceeding expected size or nesting depth for the application.
Correlate spikes in application error rates with source IPs sending oversized POST or PUT payloads.

Monitoring Recommendations

Instrument request handlers with per-request execution time metrics and alert on outliers.
Track heap allocation rate and old-generation growth in services that sanitize JSON.
Aggregate WAF or API gateway telemetry to flag repeated requests from single sources targeting JSON endpoints.

How to Mitigate CVE-2026-37736

Immediate Actions Required

Inventory all applications and dependencies using OWASP json-sanitizer 1.2.3 through software composition analysis.
Upgrade json-sanitizer to a fixed release once published by the maintainers; monitor the OWASP json-sanitizer GitHub repository for updates.
Enforce request size and JSON depth limits at the web server, API gateway, or WAF layer.
Apply per-request execution timeouts to code paths invoking JsonSanitizer.sanitize().

Patch Information

At publication time, no fixed version is referenced in the NVD entry. Track the GitHub Issue #35 for JSON Sanitizer for remediation status and consume the next tagged release from the OWASP json-sanitizer GitHub repository.

Workarounds

Wrap calls to JsonSanitizer.sanitize() in a bounded executor with a strict timeout to abort long-running sanitizations.
Reject JSON payloads above a defined byte length and structural depth before they reach the library.
Rate-limit unauthenticated endpoints that accept JSON input to reduce amplification.
Deploy a WAF rule to drop payloads matching known malformed JSON patterns targeting the sanitizer.

bash

# Example NGINX ingress limits to constrain JSON payload size
client_max_body_size 64k;
client_body_timeout 5s;
limit_req_zone $binary_remote_addr zone=json_api:10m rate=10r/s;

location /api/ {
    limit_req zone=json_api burst=20 nodelay;
    proxy_read_timeout 5s;
    proxy_pass http://backend;
}