{"id":"dc3327f403c6a24d","repo":"google/gson","slug":"number-string-too-large-value","errorCode":null,"errorMessage":"Number string too large: {value}...","messagePattern":"Number string too large: (.+?)\\.\\.\\.","errorType":"exception","errorClass":"NumberFormatException","httpStatus":null,"severity":"error","filePath":"gson/src/main/java/com/google/gson/internal/NumberLimits.java","lineNumber":17,"sourceCode":"package com.google.gson.internal;\n\nimport java.math.BigDecimal;\nimport java.math.BigInteger;\n\n/**\n * This class enforces limits on numbers parsed from JSON to avoid potential performance problems\n * when extremely large numbers are used.\n */\npublic final class NumberLimits {\n  private NumberLimits() {}\n\n  private static final int MAX_NUMBER_STRING_LENGTH = 10_000;\n\n  private static void checkNumberStringLength(String s) {\n    if (s.length() > MAX_NUMBER_STRING_LENGTH) {\n      throw new NumberFormatException(\"Number string too large: \" + s.substring(0, 30) + \"...\");\n    }\n  }\n\n  public static BigDecimal parseBigDecimal(String s) throws NumberFormatException {\n    checkNumberStringLength(s);\n    BigDecimal decimal = new BigDecimal(s);\n\n    // Cast to long to avoid issues with abs when value is Integer.MIN_VALUE\n    if (Math.abs((long) decimal.scale()) >= 10_000) {\n      throw new NumberFormatException(\"Number has unsupported scale: \" + s);\n    }\n    return decimal;\n  }\n\n  public static BigInteger parseBigInteger(String s) throws NumberFormatException {\n    checkNumberStringLength(s);\n    return new BigInteger(s);\n  }","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/google/gson/blob/8b8628c65699bc4421696183c62ae0c1b9b281dc/gson/src/main/java/com/google/gson/internal/NumberLimits.java#L1-L35","documentation":"Thrown by NumberLimits.checkNumberStringLength as NumberFormatException when a number string parsed from JSON exceeds 10,000 characters. This is a DoS defence: extremely long number literals can be expensive or destabilizing to parse into BigDecimal/BigInteger, so Gson caps the input length and rejects oversized numeric tokens early.","triggerScenarios":"Parsing a JSON document whose numeric value literal (the raw text between delimiters) is longer than 10,000 characters. Fires via LazilyParsedNumber.asBigDecimal()/NumberLimits.parseBigDecimal or parseBigInteger when the JSON reader hands on a very long number token.","commonSituations":"Untrusted JSON payloads containing pathological numbers (e.g. a single number with tens of thousands of digits); base64-or-hex-encoded blobs mis-typed as JSON numbers; adversarial/fuzzed input designed to exhaust CPU or memory.","solutions":["Validate/normalize input upstream: reject or treat excessively long number literals as strings before parsing.","If you control the schema, model the field as a JSON string rather than a number and parse it yourself with bounded precision.","Configure stream limits / content-length caps at the HTTP layer to reject oversized payloads early."],"exampleFix":"// before: unbounded numeric input\ngson.fromJson(hugeJson, BigDecimal.class); // NumberFormatException\n\n// after: read as string, then validate length\nString numStr = gson.fromJson(hugeJson, String.class);\nif (numStr.length() > 10_000) throw new IllegalArgumentException(\"too large\");\nBigDecimal v = NumberLimits.parseBigDecimal(numStr);","handlingStrategy":"validation","validationCode":"static void checkNumberLen(String s) {\n  if (s != null && s.length() > 10_000) {\n    throw new IllegalArgumentException(\"Number literal exceeds 10,000 characters\");\n  }\n}\n// usage: checkNumberLen(numStr);","typeGuard":"static boolean isAcceptableNumberLength(String s) {\n  return s != null && s.length() <= 10_000;\n}","tryCatchPattern":"try {\n  gson.fromJson(json, BigDecimal.class);\n} catch (NumberFormatException e) {\n  if (e.getMessage().contains(\"too large\")) {\n    // read as String and reject, or truncate with policy\n    throw new IllegalArgumentException(\"Payload rejected: oversized number\", e);\n  } else throw e;\n}","preventionTips":["Cap request/payload size at the HTTP layer.","Model large numeric fields as Strings in the Gson type.","Validate number literal length before parsing."],"tags":["gson","number","dos","numberformatexception","limits"],"analyzedSha":"8b8628c65699bc4421696183c62ae0c1b9b281dc","analyzedAt":"2026-08-04T19:12:22.202Z","schemaVersion":2}