{"id":"CVE-2026-24802","summary":"Buffer Overflow Vulnerability in briandilley/jsonrpc4j","details":"Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java.\n\nThis issue affects jsonrpc4j: through 1.6.0.","aliases":["GHSA-hcx3-3q5c-r5v6"],"modified":"2026-08-12T16:24:53.500873Z","published":"2026-01-27T08:38:34.944Z","database_specific":{"cna_assigner":"GovTech CSG","cwe_ids":["CWE-835"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24802.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24802.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24802"},{"type":"FIX","url":"https://github.com/briandilley/jsonrpc4j/pull/333"},{"type":"PACKAGE","url":"https://github.com/briandilley/jsonrpc4j"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/briandilley/jsonrpc4j","events":[{"introduced":"0"},{"fixed":"9ca8812ce35e64775bd8a9c69e7c51a046732f4f"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.6.0"},{"fixed":"1.6.0"}]}}],"versions":["1.5.3","1.5.2","1.5.1","1.5.0","1.4.6","1.4.4","1.4.3","1.4.1","1.4.0","1.3.3","1.3.1","1.3.0","1.2.0","jsonrpc4j-1.1","jsonrpc4j-1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24802.json","vanir_signatures_modified":"2026-08-12T16:24:53Z","vanir_signatures":[{"id":"CVE-2026-24802-1ee0d0f6","signature_type":"Line","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/client/JsonRpcClientTest.java"},"deprecated":false,"digest":{"line_hashes":["141333754800860669581630545621804734928","226410042864430098908031474249619085072","169647141789286402980502328659011372371","297491678710738017159880862192524488357"],"threshold":0.9}},{"target":{"file":"src/test/java/com/googlecode/jsonrpc4j/integration/HttpClientTest.java","function":"testGZIPRequestAndResponse"},"deprecated":false,"digest":{"function_hash":"191343609295548966978229767181702035685","length":237},"id":"CVE-2026-24802-235cd22a","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"function":"JsonRpcServer","file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcServer.java"},"deprecated":false,"digest":{"length":121,"function_hash":"41858470683517211494127441812000844337"},"id":"CVE-2026-24802-2cd5d43d"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/integration/HttpClientTest.java"},"deprecated":false,"digest":{"line_hashes":["159852358917228453573310813665677715534","301910950981302688888186854281915706071","56314621484563397286176760230662118292","245346208509188102964916439876955438308","45238035113910413644578951928698765505","334940064069170303254867989604184030956","200059033143791636337189505880060134630","131642670791483312507435637843518636114","59409814573080481981213710227660245594","44899098130601312739644151402687250969","224044803376469024280006018605459016531","65102461037108222413792971404808931960","200059033143791636337189505880060134630","204313251940231115072642173517040202407","210823223412844611780510763485812139876"],"threshold":0.9},"id":"CVE-2026-24802-313abf2e"},{"deprecated":false,"digest":{"function_hash":"51071993744270623212121595673358985374","length":205},"id":"CVE-2026-24802-40c5ae93","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/client/JsonRpcClientTest.java","function":"testInvokeNoParams"}},{"deprecated":false,"digest":{"function_hash":"114618089820252272269694552849408038091","length":529},"id":"CVE-2026-24802-4278bf81","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/server/JsonRpcServerTest.java","function":"testCorruptRequest"}},{"deprecated":false,"digest":{"line_hashes":["2646606098232920197117648739258337243","104448128525863618956190349315600573590","117384597237812446925875551457212624817","188218035352914246191007566181056499808","151027920162949907283399184751417806330","210118352822681824801362982980265528502","297101999222451683544794333654602848371","325223909018081600847033038131275964513","109469000972285924718500945038263515440","5784419808268224538822486950779176548","246179369077046523310355027290534680354","90650610948002192609475341515235408691","160386903778193453599760028982653738906","159340616759882963013973130220864926256","209955747341254801609398585919174930324","96079991343502066403502188955240558644","292462200117755458260896397442705748788","154637725022964940860931724166933978977","111429973812544150748566498413310130636","87010073895121253474292979105451021429","141906549180498315647758997164119787676","325223909018081600847033038131275964513","109469000972285924718500945038263515440","5784419808268224538822486950779176548","246179369077046523310355027290534680354","90650610948002192609475341515235408691","160386903778193453599760028982653738906","159340616759882963013973130220864926256","209955747341254801609398585919174930324","216749370144523949298406304166055513818","39756476736943025249662834769660448224","19333661852235727739980381351211977201","333411310153438233866893061431722206916","20863641444597430054824424811395880004","73138887923720116286644581563763287697","272273310300814302539348765112251357800","81051372975878956179075409160432289139","214629827118929152216765432795390818155","227700660031962158768126973960725372653","204554628570235098114207413576915128569","331494981750989849440321747502382040910","42293568306725243068068597939875690630","237376706057661853915470754209489790730","62115062516679129363800218702899213051","201003026852060325309250689787253415741","221186858552167130546566773882681474373","91972206629591839196552954383632479198","183975620919880282969049709150469060652","5191547704888395335914514288843831904","19062255820606647198997418614243533326","10632776708243189191916939852240542018","101430458996515051922394431661357920320","334115316345452976246544372063872810267","206728152639482895156425223486038413001","121206800292996272473234929953666199179","128981573366194830257489710946618511179","252287016334736081684098208432227702172","201035226485301344555387992288795881070","67087419992265468985154409256844196618","306610157849917585501223257700466409498","274349601581028635409522591070856700416","323157960863840845116190121470507211147","153775588611889924820697407684977392863","185091913325565893557830916784679382042","308457232976206470698445009240598965207","65943518317057642495898668581817819557","18602131212691181270371826612139675604","162186783135143535170392170519309076312","226322789537302094398059228376335263761","10632776708243189191916939852240542018","101430458996515051922394431661357920320","334115316345452976246544372063872810267","206728152639482895156425223486038413001","121206800292996272473234929953666199179","128981573366194830257489710946618511179","252287016334736081684098208432227702172","5784419808268224538822486950779176548","246179369077046523310355027290534680354","90650610948002192609475341515235408691","160386903778193453599760028982653738906","159340616759882963013973130220864926256","209955747341254801609398585919174930324","236733640881129876149962164737060680422","206689018785590293191757180331429102546"],"threshold":0.9},"id":"CVE-2026-24802-5b1994d9","signature_type":"Line","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/server/JsonRpcServerTest.java"}},{"id":"CVE-2026-24802-648f4a6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/ReadContext.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["22454041053079317498786413634168175964","22330702992116298631799451240776060111","313825270191513906782619014614030524447","331368454707157592981276116838832648026","139557185785103001245473845182985586467","199799073933250692897073989635037425135","310015725147119657737558551879409184471","107042824884097715977201136731427105547","316987194828884634438879261008547466579","199371145252161902517331808081860679320","295723494807295979100576722478269931882","299296219592818533104211875637832166101","119479409516158955574350142878790829185"]}},{"target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcServer.java","function":"JsonRpcServer"},"deprecated":false,"digest":{"function_hash":"172176579153188055770392794863428246282","length":118},"id":"CVE-2026-24802-66b3ed49","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f"},{"deprecated":false,"digest":{"line_hashes":["240851688478200706707056562102446899186","290429556463878801634365322781640332988","16656798700364238834582797087701023336","319343499628609744159848129194884513120","8076790977255077852326216273882368152","168668079258236471843073461631325922312","230900802825074297107425843043470706561","228422842717196382437548659159161807258","188774203787584944580724036413007936061","220728533059502988209841494022888465729","163714752958323775553298961359736852857","216109134108296135261899876719947085848","308570959162140469866057194749550630860","29533599760818704248544490110149011741","300340686069761819983943438578770816340","129132568081006374021101393831812972264"],"threshold":0.9},"id":"CVE-2026-24802-7da6ec4c","signature_type":"Line","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcBasicServer.java"}},{"deprecated":false,"digest":{"function_hash":"275160783981491478250918605524550443848","length":247},"id":"CVE-2026-24802-7e44c4b5","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"function":"handleJsonNodeRequest","file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcBasicServer.java"}},{"source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcMultiServer.java"},"deprecated":false,"digest":{"line_hashes":["272805958443991943883813152553147245305","267932766828195447522520094122406980754","155510191741692849924222626330410031102","253064361145257378413682402054940806850","87511806868232576693729125738644410303","177491917708518394989988168293553004102","2681639021241873753721104461697914276","309828946418765609440428192114213592690","321843940195074128647081943058685314873"],"threshold":0.9},"id":"CVE-2026-24802-7e6c6ce7","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"37217867306966460795213909098839416078","length":200},"id":"CVE-2026-24802-820fe8ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcServer.java","function":"createInputStream"}},{"digest":{"line_hashes":["238226643590974283700000914091976637530","261302118551470607969224390787616609713","208785006064103311841653394005172534281","3726365184814755978162356354786059493","323969395768191016897778479747059644272","61405831146226431686119898543817046422","197372547317486249574963226457062367849","259923032508434639614452565961372722730","224136785747678765177340927447316655898","19221680233545297941422267254520375413","160636117001379556428950444206471801572","289383178645649247630448432794555408687","65290751326506242353361116714973224304","169074618573729242901724070508933738063","55391145795138780039906359335821823564","64770751524835332220697368168588195961","177881296774234226352637370938496429772","316863113942124003276640743300409608269","169427072485579109884002637609606183410","271056448242090421745380520608135668613","86230192649621193386905481875507528038","232275146882366823213721571657552498860","55691115564213009721626600721177645649","308607273376333475232782010150411410130","11867083250284374128734608743338023168","186443255915360063285752416648393215058","269920765198163855704928072852591851545","237787698861441529324052886379586412655","58968762414220766514299251167353763297","179287779273290386955972817641737927279","136498863783848262873242039115067530906","274284072639015324620615313987410934937","217470785597572256853555406030804780516","31972317763633080445702577404925934724","339356600121292461357000731463771064297","128498153720284295089242065498207796213","115314220227079923836539364886106502224","284334310275558225137385210130591681524","193165709580220581326268416818519860026","121837218324176833943489854533598948611","178415884271309687259769795551073092162","67641130187806211794702301933807139269","53318034025647711539047769437876888550","312336694883878984999603281611509749244","39621581202861931414241982167312196582","24754059520344275083671808581403873836","216374006537660669536294927939677692586","131795682879627586479455627556950540956","25576514482367391595219868470749930531","82058772816277163187825471731952120488","306139067568981248875587056020099796576"],"threshold":0.9},"id":"CVE-2026-24802-98743683","signature_type":"Line","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcServer.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"291045718208710008969501231741269938982","length":139},"id":"CVE-2026-24802-9cf9f12a","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcMultiServer.java","function":"JsonRpcMultiServer"}},{"digest":{"function_hash":"330887992242840987686460873710242106176","length":168},"id":"CVE-2026-24802-a00eb5a4","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcMultiServer.java","function":"JsonRpcMultiServer"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"function":"exceptionWithAnnotatedServiceInterfaceMessageAndData","file":"src/test/java/com/googlecode/jsonrpc4j/server/JsonRpcErrorsTest.java"},"deprecated":false,"digest":{"function_hash":"33359297669031083628302006282197927505","length":587},"id":"CVE-2026-24802-abbc5bfa"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcServer.java","function":"getRequestStream"},"deprecated":false,"digest":{"function_hash":"420827941713696421516267653365112470","length":387},"id":"CVE-2026-24802-ba72fb05"},{"target":{"file":"src/main/java/com/googlecode/jsonrpc4j/ReadContext.java","function":"assertReadable"},"deprecated":false,"digest":{"function_hash":"144435947694086805220298480776474374970","length":185},"id":"CVE-2026-24802-c0b74ab9","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f"},{"signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcServer.java","function":"handleRequest0"},"deprecated":false,"digest":{"function_hash":"296306400053599609288074942752858020223","length":397},"id":"CVE-2026-24802-c1606b41","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"87072733072992415943468642226652843201","length":127},"id":"CVE-2026-24802-c973f609","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcServer.java","function":"JsonRpcServer"}},{"id":"CVE-2026-24802-d1e4d4fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/server/JsonRpcServerTest.java","function":"testGzipResponseMultipleAcceptEncoding"},"deprecated":false,"digest":{"function_hash":"38292484601720519165030625518686523055","length":704}},{"signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcServer.java","function":"JsonRpcServer"},"deprecated":false,"digest":{"length":106,"function_hash":"144589822195735452341118175528898852886"},"id":"CVE-2026-24802-d50e81db","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/integration/HttpClientTest.java","function":"testGZIPRequest"},"deprecated":false,"digest":{"function_hash":"319648663121699332526667627147609533023","length":238},"id":"CVE-2026-24802-e9e53c90","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"128872543844734742016021817066672170384","length":565},"id":"CVE-2026-24802-ebcfa6fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcBasicServer.java","function":"getBatchResponseSequentially"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/server/JsonRpcErrorsTest.java"},"deprecated":false,"digest":{"line_hashes":["275353670018251150321154664486239473543","90708220217572760800901535101207649734","55414576463880258023505451965081346969","157758230746935519257134920412877406827","192110939012642128776992692403082346315","100549558013628096795066557156664066313","217004394788171134212391414204100444482"],"threshold":0.9},"id":"CVE-2026-24802-edecdc63"},{"deprecated":false,"digest":{"function_hash":"267511147287355642540916592812746927113","length":696},"id":"CVE-2026-24802-f16a031a","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/server/JsonRpcServerTest.java","function":"testGzipResponse"}},{"digest":{"function_hash":"35502192687623413724014343840936601037","length":1685},"id":"CVE-2026-24802-f41b264e","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcBasicServer.java","function":"handleObject"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"222719937311647389647298435462505103972","length":882},"id":"CVE-2026-24802-f62573df","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/server/JsonRpcServerTest.java","function":"testGzipRequestAndResponse"}},{"id":"CVE-2026-24802-fd658003","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"file":"src/test/java/com/googlecode/jsonrpc4j/server/JsonRpcServerTest.java","function":"testGzipRequest"},"deprecated":false,"digest":{"function_hash":"8620428641281961427247978402877481880","length":839}},{"deprecated":false,"digest":{"function_hash":"61062998269173135155405796229446941010","length":103},"id":"CVE-2026-24802-fed4a0be","signature_type":"Function","signature_version":"v1","source":"https://github.com/briandilley/jsonrpc4j/commit/9ca8812ce35e64775bd8a9c69e7c51a046732f4f","target":{"function":"JsonRpcServer","file":"src/main/java/com/googlecode/jsonrpc4j/JsonRpcServer.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:L/AU:Y/R:A/V:D/RE:M/U:Amber"}]}