Posted by Daniel Owens via Fulldisclosure on Aug 29 On 26 October 2025 we published "Struts2 and Related Framework Array/Collection DoS", which was followed up on 07 March

2026 by "JSON Deserialiser Unconstrained Resource Consumption Quick Overview". Today we are publishing a proof of

concept that we have been using for more than 15 years against Struts2, Newtonsoft JSON, JSON.org, and various other

JSON parsers. We are publishing, in part, because of the theft of our...