GCVE-110-NCSC-2026-375

Advisory PublishedCVSS 5.4/10

Vulnetix · Advisory published September 16, 2026

Eclipse Parsson versions before 1.1.8 have a denial of service vulnerability due to lack of a maximum JSON character limit, affecting multiple Oracle and Red Hat products and allowing remote attackers to cause application hangs or crashes.

Download JSON Open in Console

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingCWE-94Improper Control of Generation of Code ('Code Injection')CWE-208Observable Timing DiscrepancyCWE-787Out-of-bounds WriteCWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-297Improper Validation of Certificate with Host MismatchCWE-61UNIX Symbolic Link (Symlink) FollowingCWE-1289Improper Validation of Unsafe Equivalence in InputCWE-918Server-Side Request Forgery (SSRF)CWE-116Improper Encoding or Escaping of OutputCWE-789Memory Allocation with Excessive Size ValueCWE-863Incorrect AuthorizationCWE-1284Improper Validation of Specified Quantity in InputCWE-601URL Redirection to Untrusted Site ('Open Redirect')CWE-209Generation of Error Message Containing Sensitive InformationCWE-129Improper Validation of Array IndexCWE-201Insertion of Sensitive Information Into Sent DataCWE-295Improper Certificate ValidationCWE-772Missing Release of Resource after Effective Lifetime

Risk Scores

CVSS 3.1

5.4/10

Medium · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
Oracle	vers:unknown/*	—	—

References

advisory

Browse GCVE Records

406 records in the GCVE database · Updated September 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON