[ CVE-2026-9563 · Published 2 Jul 2026 ]
Vulnerability in Eclipse Foundation Eclipse Parsson
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
NCSC-NLNCSC-2026-0448
Vulnerabilities fixed in Oracle Fusion Middleware Translated from Dutch
-
NCSC-NLNCSC-2026-0439
Vulnerabilities fixed in Oracle PeopleSoft Enterprise Translated from Dutch
-
CERT-FRCERTFR-2026-AVI-1352
Multiple vulnerabilities in Oracle PeopleSoft Translated from French
Multiple vulnerabilities have been discovered in Oracle PeopleSoft. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.
-
CERT-FRCERTFR-2026-AVI-1355
Multiple vulnerabilities in Oracle Weblogic Translated from French
Multiple vulnerabilities have been discovered in Oracle Weblogic. They allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.
-
BSI CERT-BundWID-SEC-2026-4082
Oracle PeopleSoft: Multiple vulnerabilities Translated from German
-
BSI CERT-BundWID-SEC-2026-4078
Oracle Fusion Middleware: Multiple vulnerabilities Translated from German
-
CERT-FRCERTFR-2026-AVI-1336
Multiple vulnerabilities in IBM products Translated from French
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
CERT-FRCERTFR-2026-AVI-1291
Multiple vulnerabilities in IBM products Translated from French
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
BSI CERT-BundWID-SEC-2026-3665
SOS GmbH JobScheduler: Multiple vulnerabilities allow an unspecified attack Translated from German
-
CERT-FRCERTFR-2026-AVI-1233
Multiple vulnerabilities in IBM products Translated from French
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.