The library uses a repackaged org.json parser that performs recursion on each nesting level without imposing a depth limit. Each level of nested arrays or objects triggers a direct recursive call to JSONTokener.nextValue via readArray or readObject, causing the thread’s call stack to exhaust. This results in a raw java.lang.StackOverflowError rather than a JSONException, which causes the parsing thread to terminate and leads to a denial of service. The weakness is exemplified by CWE‑674: uncontrolled recursion or loop.

Affected product is Vaadin’s Android‑JSON artifact, com.vaadin.external.google:android-json version 0.0.20131108.vaadin1, a 2013 repackaging of an older org.json implementation that is no longer maintained. No fixed version has been released and the artifact remains available in the Maven Central repository.

The CVSS base score of 6.3 indicates moderate severity, yet the denial of service impact can be critical in high‑availability deployments. No EPSS score is reported and the vulnerability is not listed in the CISA KEV catalog. The description does not specify an authenticated or remote access requirement, but the effect can be triggered by any untrusted JSON input processed by the application. The likely attack vector is an unauthenticated attacker supplying a deeply nested payload that triggers stack overflow and terminates the parsing thread. Mitigation requires replacing the library rather than a configuration change.