Files
arrow/python/pyarrow
Antoine Pitrou c74c9576f7 GH-51757: [C++] Limit max JSON nesting depth in JSON parser (#51758)
### Rationale for this change

Our JSON parser is inherently recursive, and a crafted JSON document with huge nesting can send it into a stack overflow.

Given that real-world JSON files will not have thousands levels of nesting, we limit the JSON nesting to an arbitrary value of 300.

### Are these changes tested?

Yes, by new tests.

### Are there any user-facing changes?

**This PR contains a "Critical Fix".** A crafted JSON document with a large nesting depth could trigger a denial of service through stack overflow.

### Was AI used for this PR?

**PR code and description written by:**

- [x] Human
- [ ] AI

**Reviewed before submission by:**

- [x] Human (self-reviewed)
- [ ] AI
- [ ] Not reviewed

* GitHub Issue: #51757

Authored-by: Antoine Pitrou <antoine@python.org>
Signed-off-by: Antoine Pitrou <antoine@python.org>
2026-10-07 10:14:05 +02:00
..