The JSON-java library processes numeric strings without a length limit during JSONTokener.nextSimpleValue. When an attacker supplies a very long numeric literal, the library consumes large amounts of CPU time during conversion to BigInteger or BigDecimal. This super‑linear resource consumption can block request‑handling threads, rendering the application unresponsive. The weakness is classified as unbounded resource consumption (CWE-400) and unbounded memory allocation (CWE-770).

The vulnerability exists in the stleary:JSON-java package from versions 20150729 through 20260522. Applications that use JSONObject, JSONArray, or XML.toJSONObject to parse attacker‑controlled JSON or XML may be impacted. The issue is resolved in release 20260719, which imposes a numeric conversion length limit.

The CVSS score of 5.9 indicates moderate severity; the EPSS score is not available, and it is not listed in CISA’s KEV catalog. Attackers can trigger the DoS by supplying crafted JSON or XML over any channel that the application processes. The vulnerability can be exploited remotely if the application accepts user input from network services, web APIs, or files. Downgrading or restricting numeric literals in the payload can mitigate exploitation until the library is updated.