CVE-2026-9563 Denial of service in Eclipse Parsson
Attackers can cause denial of service in applications using Eclipse Parsson by submitting large JSON documents that exhaust CPU and memory resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9563?
CVE-2026-9563 is a high-severity denial of service vulnerability in Eclipse Parsson, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters.
Which versions are affected by CVE-2026-9563?
How do I fix CVE-2026-9563?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-9563 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9563 exists.
Sources
Also known as CLEANSTART-2026-IC85563, CLEANSTART-2026-WV26329, CLEANSTART-2026-XT77636, ECHO-058e-4aa6-dafa, GHSA-q86x-4w7f-8hrm.