Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
org.eclipse.parsson packages may let attackers alter JSON data
published 3 months ago
Summary
The Eclipse org.eclipse.parsson libraries used for handling JSON can be tricked into processing malformed input, which could let a malicious user change or corrupt data. Updating to version 1.0.0‑tuxcare.1 fixes the issue. Apply the provided security update to all installations of the affected parsson packages.
What to do
- Update eclipse org.eclipse.parsson:jakarta.json to version 1.0.0-tuxcare.1.
- Update eclipse org.eclipse.parsson:parsson to version 1.0.0-tuxcare.1.
- Update eclipse org.eclipse.parsson:parsson-bundles to version 1.0.0-tuxcare.1.
- Update eclipse org.eclipse.parsson:parsson-dist to version 1.0.0-tuxcare.1.
- Update eclipse org.eclipse.parsson:parsson-media to version 1.0.0-tuxcare.1.
- Update eclipse org.eclipse.parsson:project to version 1.0.0-tuxcare.1.
- Update org.eclipse.parsson:jakarta.json to version 1.0.0-tuxcare.1.
- Update org.eclipse.parsson:parsson to version 1.0.0-tuxcare.1.
- Update org.eclipse.parsson:parsson-dist to version 1.0.0-tuxcare.1.
- Update org.eclipse.parsson:project to version 1.0.0-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | eclipse | org.eclipse.parsson:jakarta.json |
< 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
| TuxCare:Maven | eclipse | org.eclipse.parsson:parsson |
< 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
| TuxCare:Maven | eclipse | org.eclipse.parsson:parsson-bundles |
< 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
| TuxCare:Maven | eclipse | org.eclipse.parsson:parsson-dist |
< 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
| TuxCare:Maven | eclipse | org.eclipse.parsson:parsson-media |
< 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
| TuxCare:Maven | eclipse | org.eclipse.parsson:project |
< 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
| TuxCare:Maven | – | org.eclipse.parsson:jakarta.json |
>= 1.0.0, < 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
| TuxCare:Maven | – | org.eclipse.parsson:parsson |
>= 1.0.0, < 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
| TuxCare:Maven | – | org.eclipse.parsson:parsson-dist |
>= 1.0.0, < 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
| TuxCare:Maven | – | org.eclipse.parsson:project |
>= 1.0.0, < 1.0.0-tuxcare.1 Fix: upgrade to 1.0.0-tuxcare.1
|
Original advisory text
TuxCare security update for org.eclipse.parsson (2 CVEs)
TuxCare rebuilt 2 org.eclipse.parsson packages to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.
Timeline
Published4 Aug 2026
Updated2 Nov 2026
First seen15 Sep 2026
Sources
CLSA-2026-1770768565 · OSV
Track software like this
Free during beta