cJSON CVE-2026-67216

Exploitation requires that the target application actually call cJSON_Compare() on JSON the attacker can influence AND that this input be structurally equal to the reference document it is compared against - this is precisely the AT:P attack requirement in the CVSS vector, not an optional detail. The malicious document must be deeply nested (the description cites depth ~40 to reach multi-hour CPU cost); shallow documents, however large, do not produce meaningful amplification. No authentication is required per PR:N and no user interaction per UI:N. The principal limiting factor is code-path reachability: deployments that never invoke cJSON_Compare on external input, or that impose a nesting-depth limit before comparison, are not exposed regardless of the cJSON version in use.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H, base 8.2) captures the profile well: network-reachable, no privileges or user interaction, availability-only impact, but with AT:P (Attack Requirements Present) reflecting a genuine precondition - the attacker input must be structurally equal to a reference document being compared. That AT:P is the key nuance: this is not a fire-and-forget crash but requires the vulnerable code path (cJSON_Compare against attacker-influenced data) to actually exist in the deployed application, which many cJSON consumers never invoke. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation; the 8.2 severity is driven by the amplification factor (a few hundred bytes to hours of CPU) rather than by breadth or ease of triggering. Realistic priority is elevated for any service that compares untrusted JSON against a template using cJSON, and low for the majority of deployments that never pass external input to cJSON_Compare. Note also that the input Tag 'Information Disclosure' conflicts with the description and CVSS (pure availability/DoS) - the tag appears mislabeled and should not be read as an info-leak.

An application uses cJSON_Compare() to check whether an incoming JSON payload matches a reference or template document (for example, verifying a config object or webhook body against an expected structure). An attacker submits a small (~few hundred bytes) but deeply nested JSON document (depth ~40) that is structurally equal to the reference; the comparison enters exponential double-recursion and consumes hours of CPU, exhausting the worker and denying service. No public POC is referenced, but the joshua.hu write-up describes the algorithmic behavior in enough detail to reconstruct the trigger.