Skip to content
NewA calmer, faster ZeroHour
Researchmedium

JSON array proof of concept shows parser resource exhaustion

Original title: Maximised JSON Array Attacks -- "Let the Commas Hit the Floor" Proof of Concept

Full Disclosure ()1
Read at seclists.org
Part of a story covered by 2 sourcesAuthor says Struts2 JSON plugin still open to comma-array attacksMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

The authors say Apache Struts2 JSON Plugin changes through S2-072 still do not stop maximised comma-array consumption.

Daniel Owens posted a proof of concept, released on August 29, 2026 as "Commas of D00m", that demonstrates unconstrained resource consumption in many JSON parsers. The write-up says Apache Struts2 JSON Plugin S2-072 and earlier code changes do not sufficiently protect against this style of attack. The authors say they examined the plugin code. No CVE or confirmed attacks are named.

Unconfirmed: Insufficient protection in S2-072 is the authors' claim from code review, not a vendor confirmation.

Key facts
  • The proof of concept was first released on August 29, 2026.
  • It uses maximised JSON arrays and comma sequences.
  • The Struts2 claim comes from the authors' code review.
  • The post references continued insecure deserialisation discussion around the plugin.
Security assessment · AI, from the articlePublic proof of concept

Impact: unconstrained resource consumption in JSON parsers

ProductAffected
Apache Struts2 JSON PluginS2-072 and prior code changes
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1499 Endpoint Denial of Service
Tags
jsondenial-of-servicestruts2resource-consumptionproof-of-concept
Vendors
Apache
Products
Struts2 JSON Plugin

From the original article

Posted by Daniel Owens via Fulldisclosure on Oct 28 On 29 August 2026, we released "Commas of D00m" -- an old proof of concept that demonstrates unconstrained resource consumption in many JSON parsers. As recently discussed (in "Continued Apache Struts2 JSON Plugin Insecure Deserialisation"), the Apache Struts2 JSON Plugin's S2-072 and prior code changes fail to sufficiently protect against this style of attack.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.