Medium severity5.3NVD Advisory· Published Oct 20, 2026· Updated Oct 20, 2026

CVE-2026-113602

Description

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Netplex/JSON Smart V2llm-fuzzy
Range: <=2.6.0

Patches

Vulnerability mechanics

References

github.com/netplex/json-smart-v2/blob/v2.6.0/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.javanvd
github.com/netplex/json-smart-v2/issues/302nvd
www.vulncheck.com/advisories/json-smart-through-2.6.0-strict-mode-validation-bypass-via-0x1a-characternvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000