The Eclipse Parsson JSON parser did not enforce a default limit on the number of characters consumed while parsing a single JSON document, a weakness corresponding to CWE-400 (Resource Exhaustion) and CWE-770 (Allocation of Resources Without Limits). When an attacker supplies an extremely large or deeply nested JSON payload, the parser reads and processes millions of characters, consuming excessive CPU and memory. This uncontrolled resource consumption can exhaust the host application’s resources, rendering it unavailable for legitimate users and resulting in a denial of service.

Any Java application that includes the org.eclipse.parsson/parsson library from Maven Central with a version earlier than 1.1.8, released by Eclipse Foundation, is affected. The vulnerability manifests in any component that parses JSON supplied by an external source, such as web services, REST endpoints, file upload handlers, or inter-process messages. The analytical data indicates that Eclipse Parsson 1.1.8 and later introduce a configurable default limit of 15 million parser-consumed characters, which removes the flaw as long as the limit remains enabled.

The CVSS score of 7.5 signifies high severity, while an EPSS score of less than 1% reflects a low probability of exploitation at present. Based on the description, it is inferred that the flaw can be exploited without authentication or privilege; an attacker could send a large JSON payload over any input channel that the application forwards to the parser, such as HTTP request bodies or other network interfaces, thereby forcing resource exhaustion. The vulnerability is not listed in CISA KEV, implying no publicly documented exploits yet, but the attack vector is inferred from the description and typical usage patterns of JSON.