CVE-2026-37736

OWASP json-sanitizer 1.2.3 contains a denial-of-service flaw in JsonSanitizer.sanitize(), the method Java applications call to make untrusted JSON safe before parsing or storage. The flaw is classified as CWE-770 (allocation of resources without limits or throttling), meaning crafted input can drive disproportionate resource consumption during sanitization; the specific malicious input shape is not documented in the available data. An attacker who can submit crafted JSON to any service that runs this method gains the ability to exhaust CPU or memory and disrupt availability of the affected application, with no confidentiality or integrity impact per the CVSS vector. Any Java application or service embedding json-sanitizer 1.2.3 and passing attacker-controlled input through sanitize() is affected, while deployments that never feed untrusted input to this library are not meaningfully exposed. There is no public proof-of-concept, it is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days, so no active exploitation is currently known.

What to do: Inventory your Java estate and SBOMs for the json-sanitizer dependency and identify which services call JsonSanitizer.sanitize() on untrusted input, as only those are exposed. Upgrade to a fixed release when one is published — the data identifies 1.2.3 as affected but does not name a patched version, so track the OWASP project's advisory rather than assuming a specific fix version. As an interim mitigation, limit the size and nesting depth of JSON accepted on endpoints that feed sanitize(), and rate-limit or monitor those endpoints for resource exhaustion.