---
id: CVE-2026-113602
title: >-
  net.minidev/json-smart: json-smart: Input validation bypass via substitute
  character in strict mode (CVE-2026-113602)
summary: >-
  A flaw was found in json-smart. A remote attacker can exploit this input
  validation bypass vulnerability by submitting crafted JSON data containing a
  literal substitute (0x1A) character followed by malformed content. This causes
  strict-mod…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-1286
  - CWE-147
vendor: Red Hat
product: OpenShift Developer Tools and Services
affected:
  - openshift_developer_tools_and_services
  - openshift_serverless
  - build_of_apache_camel_hawtio 4
  - build_of_apache_camel_4_for_quarkus 3
  - build_of_apache_camel_for_spring_boot 4
  - build_of_apicurio_registry 3
  - build_of_debezium 3
  - data_grid 8
  - fuse 7
  - openshift_dev_spaces
published: '2026-10-20'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:00:01+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113602.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113602.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-113602'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2556274'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-113602'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-113602'
  - url: >-
      https://github.com/netplex/json-smart-v2/blob/v2.6.0/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java
  - url: 'https://github.com/netplex/json-smart-v2/issues/302'
  - url: >-
      https://www.vulncheck.com/advisories/json-smart-through-2.6.0-strict-mode-validation-bypass-via-0x1a-character
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
epss: 0.00449
epssPercentile: 0.38823
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-20T16:30:31.776341Z'
ingestedAt: '2026-10-20T16:10:53.305Z'
---

## Overview

A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute (0x1A) character followed by malformed content. This causes strict-mode validation checks to prematurely finish parsing and accept the invalid input. Consequently, this inconsistency can create parser differentials with downstream JSON parsers, potentially enabling attackers to bypass security filters or cause data integrity issues.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, … · no fix planned: OpenShift Developer Tools and Services, Red Hat Fuse 7, OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113602.json)

**net.minidev/json-smart: json-smart: Input validation bypass via substitute character in strict mode** — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-23.

Affected:

- OpenShift Developer Tools and Services
- OpenShift Serverless
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat build of Debezium 3
- Red Hat Data Grid 8
- Red Hat Fuse 7
- Red Hat OpenShift Dev Spaces

No fix planned:

- OpenShift Developer Tools and Services
- Red Hat Fuse 7
- OpenShift Serverless
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat build of Debezium 3
- Red Hat Data Grid 8
- Red Hat OpenShift Dev Spaces

## Remediation

Out of support scope

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.