CVE-2026-113602 json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character

Medium 6.9 Published 20 Oct 2026 Updated 20 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-113602?

CVE-2026-113602 is a medium-severity vulnerability in json-smart, published on 20 Oct 2026.

Official description

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating parser differentials with downstream parsers like Jackson or Gson.

Weakness: CWE-147

Which versions are affected by CVE-2026-113602?

How do I fix CVE-2026-113602?

No fix has been published for CVE-2026-113602 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-113602 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113602 exists.

Sources

Also known as DEBIAN-CVE-2026-113602, GHSA-77mf-7xf5-w9wc, UBUNTU-CVE-2026-113602.