diff --git a/README.md b/README.md
index 40acb8f06..b60cd1827 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ JSON in Java [package org.json]
[](https://github.com/stleary/JSON-java/actions/workflows/codeql-analysis.yml)
[](https://javadoc.io/doc/org.json/json)
-**[Click here if you just want the latest release jar file.](https://search.maven.org/remotecontent?filepath=org/json/json/20260522/json-20260522.jar)**
+**[Click here if you just want the latest release jar file.](https://search.maven.org/remotecontent?filepath=org/json/json/202607119/json-20260719.jar)**
# Overview
diff --git a/build.gradle b/build.gradle
index d8b69805f..f9251816c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -42,7 +42,7 @@ subprojects {
}
group = 'org.json'
-version = 'v20260522-SNAPSHOT'
+version = 'v20260719-SNAPSHOT'
description = 'JSON in Java'
sourceCompatibility = '1.8'
diff --git a/docs/RELEASES.md b/docs/RELEASES.md
index 7513766ff..43edf3ae5 100644
--- a/docs/RELEASES.md
+++ b/docs/RELEASES.md
@@ -5,6 +5,8 @@ and artifactId "json". For example:
[https://search.maven.org/search?q=g:org.json%20AND%20a:json&core=gav](https://search.maven.org/search?q=g:org.json%20AND%20a:json&core=gav)
~~~
+20260719 Fixes CVE-2026-59171 very large BigInteger, BigDecimal
+
20260522 Publish key data, recent commits for minor fixes
20251224 Records, fromJson(), and recent commits
diff --git a/pom.xml b/pom.xml
index 3f15d6896..d5fb42ddc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
org.json
json
- 20260522
+ 20260719
bundle
JSON in Java
diff --git a/src/test/java/org/json/junit/JSONObjectTest.java b/src/test/java/org/json/junit/JSONObjectTest.java
index fabaa5a31..6b692789e 100644
--- a/src/test/java/org/json/junit/JSONObjectTest.java
+++ b/src/test/java/org/json/junit/JSONObjectTest.java
@@ -3885,6 +3885,7 @@ public void jsonObjectParseFromJson_9() {
@Test
public void testMaxNumberLength() {
+ JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
StringBuilder sb = new StringBuilder();
for (int i = 0; i < 100; ++i) {
sb.append("9999999999");
@@ -3896,11 +3897,14 @@ public void testMaxNumberLength() {
// JSONArray with number just under the max length limit
checkJSONArrayMaxLen(sb.toString(), true, null);
- // JSONObject with number just over the max length limit
- checkJSONObjectMaxLen(sb + "9", false, null);
+ // numbers without quotes are not allowed in strict mode
+ if (!jsonParserConfiguration.isStrictMode()) {
+ // JSONObject with number just over the max length limit
+ checkJSONObjectMaxLen(sb + "9", false, null);
- // JSONArray with number just over the max length limit
- checkJSONArrayMaxLen(sb + "9", false, null);
+ // JSONArray with number just over the max length limit
+ checkJSONArrayMaxLen(sb + "9", false, null);
+ }
// JSONObject with number at config max length limit
checkJSONObjectMaxLen(sb.toString() + sb.toString(), true, new JSONParserConfiguration().withMaxNumberLength(2000));
@@ -3908,11 +3912,14 @@ public void testMaxNumberLength() {
// JSONArray with number at config max length limit
checkJSONArrayMaxLen((sb.toString() + sb), true, new JSONParserConfiguration().withMaxNumberLength(2000));
- // JSONObject with number just over config max length limit
- checkJSONObjectMaxLen(sb.toString() + sb.toString() + "9", false, new JSONParserConfiguration().withMaxNumberLength(2000));
+ // numbers without quotes are not allowed in strict mode
+ if (!jsonParserConfiguration.isStrictMode()) {
+ // JSONObject with number just over config max length limit
+ checkJSONObjectMaxLen(sb.toString() + sb.toString() + "9", false, new JSONParserConfiguration().withMaxNumberLength(2000));
- // JSONArray with number just over config max length limit
- checkJSONArrayMaxLen((sb.toString() + sb + "9"), false, new JSONParserConfiguration().withMaxNumberLength(2000));
+ // JSONArray with number just over config max length limit
+ checkJSONArrayMaxLen((sb.toString() + sb + "9"), false, new JSONParserConfiguration().withMaxNumberLength(2000));
+ }
// JSONObject with large number, no checks
checkJSONObjectMaxLen(sb.toString() + sb.toString() + "9", true,
@@ -3975,6 +3982,8 @@ private static void checkJSONArrayMaxLen(String s, boolean isValid, JSONParserCo
*/
@Test
public void testMaxNumberLengthNegativeInteger() {
+ JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
+
// Build a negative number string of exactly 1000 chars: "-" + 999 digits
StringBuilder sb = new StringBuilder("-");
for (int i = 0; i < 999; ++i) {
@@ -3985,10 +3994,13 @@ public void testMaxNumberLengthNegativeInteger() {
// at max length: parsed as number
checkJSONObjectMaxLen(sb.toString(), true, null);
- // over max length: returned as string
- sb.append("1");
- assertEquals(1001, sb.length());
- checkJSONObjectMaxLen(sb.toString(), false, null);
+ // numbers without quotes are not allowed in strict mode
+ if (!jsonParserConfiguration.isStrictMode()) {
+ // over max length: returned as string
+ sb.append("1");
+ assertEquals(1001, sb.length());
+ checkJSONObjectMaxLen(sb.toString(), false, null);
+ }
}
/**
@@ -3996,6 +4008,8 @@ public void testMaxNumberLengthNegativeInteger() {
*/
@Test
public void testMaxNumberLengthDecimal() {
+ JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
+
// Build a decimal number string of exactly 1000 chars: 499 digits + "." + 500
// digits
StringBuilder sb = new StringBuilder();
@@ -4011,10 +4025,13 @@ public void testMaxNumberLengthDecimal() {
// at max length: parsed as number (BigDecimal)
checkJSONObjectMaxLen(sb.toString(), true, null);
- // over max length: returned as string
- sb.append("3");
- assertEquals(1001, sb.length());
- checkJSONObjectMaxLen(sb.toString(), false, null);
+ // numbers without quotes are not allowed in strict mode
+ if (!jsonParserConfiguration.isStrictMode()) {
+ // over max length: returned as string
+ sb.append("3");
+ assertEquals(1001, sb.length());
+ checkJSONObjectMaxLen(sb.toString(), false, null);
+ }
}
/**
@@ -4022,6 +4039,8 @@ public void testMaxNumberLengthDecimal() {
*/
@Test
public void testMaxNumberLengthScientificNotation() {
+ JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
+
// Build a scientific notation string of exactly 1000 chars
StringBuilder sb = new StringBuilder("1.");
for (int i = 0; i < 994; ++i) {
@@ -4038,9 +4057,13 @@ public void testMaxNumberLengthScientificNotation() {
for (int i = 0; i < 995; ++i) {
sb.append("0");
}
- sb.append("e100");
- assertEquals(1001, sb.length());
- checkJSONObjectMaxLen(sb.toString(), false, null);
+
+ // numbers without quotes are not allowed in strict mode
+ if (!jsonParserConfiguration.isStrictMode()) {
+ sb.append("e100");
+ assertEquals(1001, sb.length());
+ checkJSONObjectMaxLen(sb.toString(), false, null);
+ }
}
/**
@@ -4297,17 +4320,21 @@ public void testStringToValueViaJSONObject() {
*/
@Test
public void testStringToNumberInvalidFormats() {
- // Leading zero followed by digit → treated as string (not octal)
- JSONObject jo = new JSONObject("{\"a\": 01}");
- // JSONTokener with strict mode would reject, but default mode stores as string
- // since stringToNumber throws NumberFormatException for "01"
- Object val = jo.get("a");
- assertTrue("01 should be stored as string, got " + val.getClass(), val instanceof String);
-
- // Negative with leading zero → "-01"
- jo = new JSONObject("{\"a\": -01}");
- val = jo.get("a");
- assertTrue("-01 should be stored as string, got " + val.getClass(), val instanceof String);
+ // this test should only run in non-strict mode, otherwise it will throw an exception
+ JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
+ if (!jsonParserConfiguration.isStrictMode()) {
+ // Leading zero followed by digit → treated as string (not octal)
+ JSONObject jo = new JSONObject("{\"a\": 01}");
+ // JSONTokener with strict mode would reject, but default mode stores as string
+ // since stringToNumber throws NumberFormatException for "01"
+ Object val = jo.get("a");
+ assertTrue("01 should be stored as string, got " + val.getClass(), val instanceof String);
+
+ // Negative with leading zero → "-01"
+ jo = new JSONObject("{\"a\": -01}");
+ val = jo.get("a");
+ assertTrue("-01 should be stored as string, got " + val.getClass(), val instanceof String);
+ }
}
}