Maximised JSON Array Attacks -- "Let the Commas Hit the Floor" Proof of Concept

Posted by Daniel Owens via Fulldisclosure on Oct 28On 29 August 2026, we released "Commas of D00m" -- an old proof of concept that demonstrates unconstrained resource consumption in many JSON parsers. As recently discussed (in "Continued Apache Struts2 JSON Plugin Insecure Deserialisation"), the Apache Struts2 JSON Plugin's S2-072 and prior code... Weiterlesen: Maximised JSON Array Attacks -- "Let the Commas Hit the Floor" Proof …