Vulnerability · Published Jan 27, 2026 · Assigned by GovTech CSG

CVE-2026-24802Buffer Overflow Vulnerability in briandilley/jsonrpc4j

Medium 5.3

In plain English

A medium-severity infinite loop in jsonrpc4j from briandilley. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java. This issue affects jsonrpc4j: through 1.6.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.github.briandilley.jsonrpc4j:jsonrpc4j	1.7.0	GHSA-hcx3-3q5c-r5v6

Affected products (as reported)

Vendor	Product	Versions
briandilley	jsonrpc4j	0 – through 1.6.0

Weakness: CWE-835 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:L/AU:Y/R:A/V:D/RE:M/U:Amber

References

https://github.com/briandilley/jsonrpc4j/pull/333 patch