5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24802

CVE-2026-24802: jsonrpc4j has Infinite Loop in RPC Stream Writer

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java.

This issue affects jsonrpc4j: through 1.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24802

CVE-2026-24802:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.github.briandilley.jsonrpc4j:jsonrpc4j	maven	< 1.7.0	1.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security patch (commit 087f5268eaf901f90d1e84062def77faa52ad8b2) reveals that the vulnerability lies within the write(byte[] b, int off, int len) method of the com.googlecode.jsonrpc4j.NoCloseOutputStream class. The vulnerability description mentions an infinite loop, but the patch and commit message point to a buffer overflow/out-of-bounds write condition. Before the patch, the method directly passed the b, off, and len arguments to the write method of the underlying OutputStream (ops) without any validation. This could be exploited by passing negative or out-of-range values for off and len, leading to an ArrayIndexOutOfBoundsException and a denial of service. The patch rectifies this by introducing validation to check if the buffer b is null and if the off and len parameters are within the valid range of the buffer's length. Therefore, the com.googlecode.jsonrpc4j.NoCloseOutputStream.write function is the vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

com.googlecode.jsonrpc4j.NoCloseOutputStream.write

src/main/java/com/googlecode/jsonrpc4j/NoCloseOutputStream.java

The `write` method in `NoCloseOutputStream` was vulnerable because it did not validate the `off` and `len` parameters before passing them to the underlying `OutputStream`. An attacker could provide malicious `offset` and `length` values, causing an `ArrayIndexOutOfBoundsException` which could lead to a denial of service. The patch mitigates this by adding checks to ensure `off` and `len` are within the bounds of the byte array `b`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.