Bug 2556274 (CVE-2026-113602)
| Summary: | CVE-2026-113602 net.minidev/json-smart: json-smart: Input validation bypass via substitute character in strict mode | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abrianik, asyoung, ccranfor, cmah, dhanak, drosa, dsimansk, ewittman, fmariani, fmongiar, ggrzybek, gmalinko, gtanzill, janstey, jbuscemi, jhollowa, jnethert, jpechane, jraez, jwon, kaycoth, kingland, mcarlett, mnovotny, nipatil, pantinor, parichar, pdelbell, pjindal, prichard, rkubis, rstepani, sausingh, sdawley, sthirugn, tasato, tcunning, yfang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute (0x1A) character followed by malformed content. This causes strict-mode validation checks to prematurely finish parsing and accept the invalid input. Consequently, this inconsistency can create parser differentials with downstream JSON parsers, potentially enabling attackers to bypass security filters or cause data integrity issues.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-20 15:53:08 UTC
|