{"id":"CVE-2026-113602","title":"net.minidev/json-smart: json-smart: Input validation bypass via substitute character in strict mode (CVE-2026-113602)","summary":"A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute (0x1A) character followed by malformed content. This causes strict-mod…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"vendor","cwe":["CWE-1286","CWE-147"],"vendor":"Red Hat","product":"OpenShift Developer Tools and Services","affected":["openshift_developer_tools_and_services","openshift_serverless","build_of_apache_camel_hawtio 4","build_of_apache_camel_4_for_quarkus 3","build_of_apache_camel_for_spring_boot 4","build_of_apicurio_registry 3","build_of_debezium 3","data_grid 8","fuse 7","openshift_dev_spaces"],"published":"2026-10-20","updated":"2026-10-23","sourceUpdated":"2026-10-23T11:00:01+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113602.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113602.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-113602"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556274"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-113602"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113602"},{"url":"https://github.com/netplex/json-smart-v2/blob/v2.6.0/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java"},{"url":"https://github.com/netplex/json-smart-v2/issues/302"},{"url":"https://www.vulncheck.com/advisories/json-smart-through-2.6.0-strict-mode-validation-bypass-via-0x1a-character"}],"tags":["csaf","vex","red-hat","cve.org","exploit-available"],"epss":0.00449,"epssPercentile":0.38823,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-20T16:30:31.776341Z"},"ingestedAt":"2026-10-20T16:10:53.305Z","slug":"CVE-2026-113602","body":"## Overview\n\nA flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute (0x1A) character followed by malformed content. This causes strict-mode validation checks to prematurely finish parsing and accept the invalid input. Consequently, this inconsistency can create parser differentials with downstream JSON parsers, potentially enabling attackers to bypass security filters or cause data integrity issues.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, … · no fix planned: OpenShift Developer Tools and Services, Red Hat Fuse 7, OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113602.json)\n\n**net.minidev/json-smart: json-smart: Input validation bypass via substitute character in strict mode** — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-23.\n\nAffected:\n\n- OpenShift Developer Tools and Services\n- OpenShift Serverless\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Debezium 3\n- Red Hat Data Grid 8\n- Red Hat Fuse 7\n- Red Hat OpenShift Dev Spaces\n\nNo fix planned:\n\n- OpenShift Developer Tools and Services\n- Red Hat Fuse 7\n- OpenShift Serverless\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Debezium 3\n- Red Hat Data Grid 8\n- Red Hat OpenShift Dev Spaces\n\n## Remediation\n\nOut of support scope\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":226003,"id":"CVE-2026-113602","ts":1792516421713,"field":"exploit_available","old":"false","new":"true"}]}