<!-- Note that this issue is configured (see the quick actions at the bottom) to be created as confidential. Note that a vulnerability does not need to actually be resolved before it is reported and that these reports can be revised as needed (reopen the issue to request changes). If you do not know how to fill certain fields, mark that in the comment and we will help you. You can delete the comments (or not). --> <!-- Required. Specify the project's name (e.g., "Eclipse Dash") and Eclipse Foundation ID, e.g., "technology.dash". --> ## Basic information **Project name:** jakartaee/jsonp-api **Project id:** https://projects.eclipse.org/projects/ee4j.jsonp ## What are the affected versions? Not specified ## Details of the issue This issues has been reported to the security@ mailing list I have discovered a DoS (Denial of Service) vulnerability in the latest version 2.1.2 of jakartaee/jsonp-api(https://projects.eclipse.org/projects/ee4j.jsonp、https://github.com/jakartaee/jsonp-api).The demo test code is as follows: ``` import jakarta.json.Json; import jakarta.json.JsonArray; import java.math.BigDecimal; xxxxx JsonArray array = Json.createArrayBuilder() .add(new BigDecimal("1e99999999")) .build(); array.getJsonNumber(0).bigIntegerValue(); ``` The cause is that when processing BigDecimal, passing in a number that is too large (such as 1e99999999) will cause a lot of additional resources to be used for processing. If the user can control the input content data, for example, by calling Json.createArrayBuilder().add(data), it can cause a DoS issue. ## Do you know any mitigations of the issue? Not known <!-- Please, do not remove the line below. It will create a confidential issue that will be visible only to you and the members of this project. Confidential issues are used to keep security vulnerabilities private until they are sorted out. Eclipse Projects follow Responsible Disclosure best practices: the initial report is made privately, but with the full details being published once a patch has been made available (sometimes with a delay to allow more time for the patches to be installed). -->