EUVD-2026-50327
GHSA-5q3m-r3x7-8phg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remotely reachable JSON Patch input with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only process crash (A:H), no confidentiality or integrity effect.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service.
AnalysisAI
Denial of service in cJSON (DaveGamble's C JSON parser) through version 1.7.19 lets a remote attacker crash any application that applies an untrusted RFC 6902 JSON Patch through cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). By combining add and copy operations that graft duplicated subtrees, an attacker inflates document nesting far beyond the parser's 1000-level limit, and the unbounded recursion in cJSON_Delete() (plus a permissive CJSON_CIRCULAR_LIMIT of 10000 in cJSON_Duplicate()) exhausts the thread stack. Reported by VulnCheck with a public technical write-up; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Technical ContextAI
cJSON is an ultralightweight JSON parser written in ANSI C and one of the most widely embedded JSON libraries in C/C++ software, firmware, and IoT devices. The flaw is a CWE-674 (Uncontrolled Recursion) issue in the cJSON_Utils JSON Patch subsystem: while the parser caps input nesting at 1000 levels, the tree-manipulation helpers do not enforce that bound after construction. RFC 6902 'add' and 'copy' patch operations can duplicate and re-attach subtrees, so a modestly sized patch amplifies logical document depth. The recursive cJSON_Delete() has no depth guard, and cJSON_Duplicate()'s CJSON_CIRCULAR_LIMIT guard is set to 10000 - ten times the parser limit and high enough that the resulting recursion overflows a default thread stack before the guard trips. Affected CPE: cpe:2.3:a:davegamble:cjson (all versions up to and including 1.7.19), specifically cJSON.c lines 253-261 and cJSON_Utils.c lines 906-940.
RemediationAI
No vendor-released patch version is identified at time of analysis, so upgrade to the latest cJSON release once a fixed version is published and monitor the upstream repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion) and technical write-up (https://joshua.hu/cjson-json-parser-cve-vulnerabilities) for the fixed tag. As specific compensating controls until a patch is available: avoid exposing cJSONUtils_ApplyPatches()/cJSONUtils_ApplyPatchesCaseSensitive() to untrusted input, or reject/validate incoming JSON Patch documents by capping the number and type of add/copy operations and enforcing a maximum resulting document depth before applying them (trade-off: rejects legitimately deep patches). Where feasible, run patch application on a thread with an enlarged stack or in a sandboxed/isolated worker so a stack overflow crashes only a contained process rather than the whole service (trade-off: added complexity and resource use, does not eliminate the DoS). Do not invent a fix version - cite the exact patched release only once the vendor publishes it.
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. Rated critical severity (CVSS 9.8), this
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. Rated critical severity (CVSS 9.8)
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can r
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can resu
cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of func
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. Rated
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. Ra
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. Rated high severity (
Denial of service in the cJSON C library (versions through 1.7.19) arises from exponential algorithmic complexity in the
Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial
Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today