Crow CVE-2026-116011

The target Crow application (version <1.3.4) must expose a route that passes attacker-controlled request-body data to crow::json::load() - the published PoC uses a POST /json handler doing exactly this. No authentication, user interaction, or special feature flag is required (PR:N/UI:N). The decisive LIMITING factor is the server's worker-thread stack size: the advisory states the process crashes reliably on Windows (1MB default stack, ~4000 nested objects), whereas Linux's ~8MB default stack resists the demonstrated depth; a reverse proxy that rejects oversized request bodies also prevents the attack. Pre-patch, max_depth was 10000, well above the ~4000 levels needed to overflow a 1MB stack; the fix lowers it to 1024 and adds an explicit depth check returning a parse error.

This is a legitimately actionable availability issue, though not a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity reach with no user interaction, and impact is confined to availability (VA:H; VC:N/VI:N - no data disclosure or integrity loss). The vuln.today decision label is 'this_week', consistent with a serious-but-not-'act_now' DoS. Exploitation status: publicly available exploit code exists (full PoC server and client are published in the GHSA advisory), but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active in-the-wild exploitation - treat this as exploit-code-available, not confirmed exploited. A key nuance the raw CVSS score hides: the advisory states the crash is platform-dependent. Windows (1MB default thread stack) dies at roughly 4000 nested objects, whereas Linux's ~8MB default stack is far more resilient to the tested 4000-depth payload, and a reverse proxy enforcing a small request-body limit blunts the attack entirely. So AC:L/VA:H is accurate for a vulnerable Windows deployment, but real-world risk varies sharply by platform and fronting infrastructure. Net: a real priority for Windows-hosted Crow services exposing JSON endpoints, lower practical urgency elsewhere.

An attacker sends a single unauthenticated POST request to any Crow endpoint that calls crow::json::load() on the request body, with a payload of several thousand nested JSON objects (e.g. {"a":{"a":... 4000 deep). The recursive-descent parser consumes ~250 bytes of stack per level, overflowing the 1MB default Windows worker-thread stack and terminating the whole process - a stack overflow is not catchable with try/catch - which drops all active connections. A complete working PoC (client and server) is published in the GHSA advisory.