json-smart Input Validation Bypass via 0x1A Character

Executive Summary

CVE-2026-113602 is an input validation bypass in json-smart versions up to 2.6.0. Attackers can insert a literal 0x1A character into JSON payloads to evade strict-mode trailing-data checks. This bypasses validation in functions like JSONValue.parseStrict or isValidJsonStrict, allowing malformed content to pass as valid JSON. The issue stems from the parser incorrectly treating 0x1A as an end-of-input marker while it is also a valid JSON character.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems using json-smart library versions up to 2.6.0. Check for applications parsing JSON with strict validation modes like JSONValue.parseStrict or isValidJsonStrict. Look for unexpected 0x1A characters in JSON inputs that bypass validation. Use commands like 'find / -name "*.jar" -exec grep -l "json-smart" {} \;' to locate affected libraries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to parser differentials where downstream parsers like Jackson or Gson process malformed input differently than json-smart. This may cause data integrity issues, silent truncation of JSON content, or incorrect validation of malicious payloads. While not enabling remote code execution, it compromises strict JSON validation intended for security.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade json-smart to versions beyond 2.6.0 if available. As a temporary fix, sanitize untrusted input by removing 0x1A bytes before JSON validation. Disable strict validation modes if not required. Monitor for parser differentials in downstream systems like Jackson or Gson.

Useful 0 Not Useful 0