EUVD-2026-50328
GHSA-ff2v-f99f-wm3f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable DoS with no auth or interaction, but AC:H because the payload must be deeply nested and structurally equal to the compared reference; availability-only impact (A:H, C/I:N).
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
AnalysisAI
Denial of service in the cJSON C library (versions through 1.7.19) arises from exponential algorithmic complexity in the cJSON_Compare() function, which recursively descends into each shared object subtree twice per level with no depth guard. Applications that call cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document can be forced to burn hours of CPU on a document of only a few hundred bytes (nesting depth around 40), with cost roughly doubling per added level. No public exploit identified at time of analysis and the issue is not on CISA KEV; impact is compute exhaustion only, with no confidentiality or integrity effect.
Technical ContextAI
cJSON is a widely used, ultralight JSON parser and manipulation library written in C by Dave Gamble, commonly embedded in firmware, IoT devices, and native applications. The flaw is classed as CWE-407 (Inefficient Algorithmic Complexity). In cJSON_Compare() (see cJSON.c lines ~3057-3180 in v1.7.19), object comparison walks shared keys and recurses into each matching subtree in both directions without memoization or a recursion/depth limit, so equal nested structures are revisited redundantly at every level. Running time therefore grows exponentially with nesting depth rather than linearly with document size, making input byte-size a poor proxy for cost - a tiny but deeply nested document dominates CPU. The vendor CPE identifies the affected component as cpe:2.3:a:davegamble:cjson.
RemediationAI
No vendor-released patch identified at time of analysis - the references point to the vulnerable v1.7.19 source and advisories rather than a tagged fixed release, so upgrade to a fixed cJSON version once published and monitor the DaveGamble/cJSON repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service). As concrete interim controls: avoid calling cJSON_Compare() on untrusted JSON - replace equality checks with a bounded comparison or normalize/validate input first; enforce a maximum JSON nesting depth (for example reject documents deeper than 20-30 levels) before comparison, since the attack depends on deep nesting rather than size, accepting that this may reject legitimately deep but benign payloads; wrap comparison calls in a per-request CPU/time budget or watchdog so a runaway compare is aborted rather than pinning a core; and treat request-body size limits only as a weak secondary control because a few-hundred-byte document already suffices. The technical write-up at https://joshua.hu/cjson-json-parser-cve-vulnerabilities details the root cause for anyone applying a local patch.
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. Rated critical severity (CVSS 9.8), this
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. Rated critical severity (CVSS 9.8)
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can r
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can resu
cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of func
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. Rated
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. Ra
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. Rated high severity (
Denial of service in cJSON (DaveGamble's C JSON parser) through version 1.7.19 lets a remote attacker crash any applicat
Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial
Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today