CVE-2026-9563: Eclipse Parsson JSON Parser DoS Vulnerability

CVE-2026-9563 Overview

CVE-2026-9563 affects Eclipse Parsson, the reference implementation of the Jakarta JSON Processing API distributed via Maven Central. Versions prior to 1.1.8 do not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker-controlled JSON can be forced to consume excessive CPU and memory when processing very large documents. Malicious inputs may include oversized arrays, objects, strings, numbers, whitespace, or deeply nested structures. The resulting resource exhaustion produces a denial of service against the parsing application. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default cap of 15 million parser-consumed characters. The vulnerability is tracked under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Remote unauthenticated attackers can trigger denial of service in any application that parses untrusted JSON with vulnerable Eclipse Parsson releases.

Affected Products

Eclipse Parsson Maven Central artifacts prior to version 1.1.8
Applications embedding the Jakarta JSON Processing reference implementation via org.eclipse.parsson:parsson
Downstream Jakarta EE runtimes and libraries bundling vulnerable Parsson releases

Discovery Timeline

2026-07-02 - CVE-2026-9563 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-9563

Vulnerability Analysis

Eclipse Parsson provides streaming and object-model JSON parsing for Jakarta EE applications. Before release 1.1.8, the parser accepted JSON documents of arbitrary size without an upstream ceiling on parser-consumed characters. An attacker who controls JSON input can supply a payload that forces the parser to allocate large buffers or perform prolonged tokenization work. The parser processes every character in structures such as long arrays, deeply nested objects, oversized string literals, and extended runs of whitespace or numeric digits. This behavior maps to [CWE-400] Uncontrolled Resource Consumption. Successful exploitation degrades availability of the hosting service, potentially cascading to dependent components sharing the same JVM thread pool or heap.

Root Cause

The root cause is the absence of an enforced upper bound on total characters consumed during parsing. Because the parser lacked a configurable limit, applications had no built-in mechanism to reject pathological inputs before resource exhaustion occurred. The patch in Parsson 1.1.8 introduces a JSON input size limit in JsonContext and adds corresponding error messages in JsonMessages.

Attack Vector

Exploitation requires only the ability to submit JSON to a parsing endpoint. This includes REST APIs, message consumers, webhooks, and any surface that deserializes JSON via Parsson. No authentication or user interaction is required when the endpoint is exposed to untrusted callers.

java

/*
- * Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2023, 2026 Oracle and/or its affiliates. All rights reserved.
 *
 * This program and the accompanying materials are made available under the
 * terms of the Eclipse Public License v. 2.0, which is available at
*/
// Source: https://github.com/eclipse-ee4j/parsson/commit/134e8d101aa74c8b9302d0cb62f6ccb4912a9d0c
// Patch introduces a configurable maximum parsing limit in JsonContext
// with a default of 15,000,000 parser-consumed characters.

Detection Methods for CVE-2026-9563

Indicators of Compromise

Sustained high CPU utilization on JVM processes correlated with inbound JSON traffic
Heap growth or OutOfMemoryError events in application logs during JSON deserialization
HTTP requests with abnormally large Content-Length values targeting JSON endpoints
Thread pool starvation or request timeouts localized to endpoints invoking Parsson parsers

Detection Strategies

Inventory Java applications for org.eclipse.parsson:parsson dependencies at versions below 1.1.8 using software composition analysis tools
Instrument JSON parsing paths with metrics tracking parse duration and payload size to flag outliers
Correlate application performance monitoring anomalies with request payload characteristics at ingress

Monitoring Recommendations

Log request payload sizes at API gateways and alert on values exceeding operational baselines
Monitor JVM garbage collection frequency and pause times for parsing worker pools
Track HTTP 5xx and timeout rates on endpoints that accept JSON from external callers

How to Mitigate CVE-2026-9563

Immediate Actions Required

Upgrade org.eclipse.parsson:parsson to version 1.1.8 or later across all application dependencies and transitive references
Rebuild and redeploy Jakarta EE applications, container images, and shaded JARs that bundle vulnerable Parsson releases
Enforce request body size limits at reverse proxies, API gateways, and web application firewalls fronting JSON endpoints

Patch Information

Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default of 15 million parser-consumed characters. The fix is available via the GitHub Release Version 1.1.8 and Maven Repository Parsson 1.1.8. Full change details are documented in the GitHub Pull Request and the GitHub Commit Update. Additional context is provided in the Eclipse Security Vulnerability Report.

Workarounds

Restrict maximum HTTP request body size at load balancers and reverse proxies to reject oversized JSON payloads
Terminate JSON parsing behind timeouts and per-request memory ceilings enforced by the application container
Require authentication and rate limiting on endpoints that accept JSON from external sources when upgrade is delayed

bash

# Maven dependency update to remediated version
# pom.xml
# <dependency>
#   <groupId>org.eclipse.parsson</groupId>
#   <artifactId>parsson</artifactId>
#   <version>1.1.8</version>
# </dependency>

mvn versions:use-dep-version \
  -Dincludes=org.eclipse.parsson:parsson \
  -DdepVersion=1.1.8 \
  -DforceVersion=true

mvn dependency:tree | grep parsson