google/gson · critical · JsonParseException

Failed parsing JSON source: {reader} to Json

Error message

Failed parsing JSON source: {reader} to Json

What it means

Thrown by JsonParser.parseReader(JsonReader) when Streams.parse(reader) raises StackOverflowError or OutOfMemoryError, wrapping the VM error in a JsonParseException. It almost always indicates pathologically deep or huge JSON that exceeds default stack/heap limits rather than a syntax problem.

Source

Thrown at gson/src/main/java/com/google/gson/JsonParser.java:146

   * Strictness#STRICT}, that strictness will be used for parsing. Otherwise the strictness will be
   * temporarily changed to {@link Strictness#LENIENT} and will be restored once this method
   * returns.
   *
   * @throws JsonParseException if there is an IOException or if the specified text is not valid
   *     JSON
   * @since 2.8.6
   */
  public static JsonElement parseReader(JsonReader reader)
      throws JsonIOException, JsonSyntaxException {
    Strictness strictness = reader.getStrictness();
    if (strictness == Strictness.LEGACY_STRICT) {
      // For backward compatibility change to LENIENT if reader has default strictness LEGACY_STRICT
      reader.setStrictness(Strictness.LENIENT);
    }
    try {
      return Streams.parse(reader);
    } catch (StackOverflowError | OutOfMemoryError e) {
      throw new JsonParseException("Failed parsing JSON source: " + reader + " to Json", e);
    } finally {
      reader.setStrictness(strictness);
    }
  }

  /**
   * @deprecated Use {@link JsonParser#parseString}
   */
  @Deprecated
  @InlineMe(replacement = "JsonParser.parseString(json)", imports = "com.google.gson.JsonParser")
  public JsonElement parse(String json) throws JsonSyntaxException {
    return parseString(json);
  }

  /**
   * @deprecated Use {@link JsonParser#parseReader(Reader)}
   */
  @Deprecated

View on GitHub (pinned to 8b8628c656)

Solutions

1. Raise -Xss (thread stack) and/or -Xmx if the input is legitimately large.
2. Bound nesting depth by streaming with JsonReader and rejecting documents beyond a depth threshold before full parse.
3. Cap request body size at the network boundary to prevent heap exhaustion.
4. Reject or pre-validate untrusted JSON with a depth/size limit before handing it to Gson.

Example fix

// before
JsonElement e = JsonParser.parseReader(reader);

// after (depth-bounded streaming)
try (JsonReader r = new JsonReader(reader)) {
  // read tokens, throw custom exception if depth > MAX_DEPTH
} catch (StackOverflowError s) {
  throw new IllegalArgumentException("JSON nesting too deep", s);
}

// reject documents beyond size/depth limits before parsing
if (json.length() > MAX_BYTES) throw new IllegalArgumentException("too large");

boolean withinDepthLimit(JsonElement e, int max) {
  if (max < 0) return false;
  if (e.isJsonObject())
    return e.getAsJsonObject().entrySet().stream()
      .allMatch(x -> withinDepthLimit(x.getValue(), max - 1));
  if (e.isJsonArray())
    return e.getAsJsonArray().asList().stream()
      .allMatch(x -> withinDepthLimit(x, max - 1));
  return true;
}

try {
  return JsonParser.parseReader(reader);
} catch (JsonParseException ex) {
  if (ex.getCause() instanceof StackOverflowError
      || ex.getCause() instanceof OutOfMemoryError) {
    throw new IllegalArgumentException("input too large or deeply nested", ex);
  }
  throw ex;
}

When it happens

Trigger: Parsing deeply nested JSON (thousands of nested objects/arrays) triggering StackOverflowError; parsing a multi-GB single document exhausting heap; recursive data structures serialized verbatim.

Common situations: Untrusted input from web crawlers; misbehaving upstream producing unbounded nesting; default -Xss/-Xmx too small for the workload; gzip bombs expanded by a proxy.

Related errors

• Failed parsing JSON source to Json
• No time zone indicator
• Invalid time zone indicator {timezoneIndicator}
• Failed to parse date [{input}]: {fail.getMessage()}
• {value}

AI-assisted analysis of google/gson@8b8628c656 (2026-08-04). Data as JSON: /data/errors/a811dabef5ae53ba.json. Report an issue: GitHub.