Maximised JSON Array Attacks -- "Let the Commas Hit the Floor" Proof of Concept
// AI summary
Daniel Owens released Commas of D00m, a proof of concept demonstrating unconstrained resource consumption in many JSON parsers, affecting the Apache Struts2 JSON Plugin S2-072 and prior code.
// from the source
Posted by Daniel Owens via Fulldisclosure on Oct 28 On 29 August 2026, we released Commas of D00m -- an old proof of concept that demonstrates unconstrained resource consumption in many JSON parsers. As recently discussed (in Continued Apache Struts2 JSON Plugin Insecure Deserialisation ), the Apache Struts2 JSON Plugin s S2-072 and prior code changes fail to sufficiently protect against this style of attack. In that write-up, we examined the code and the...