Cjson

Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently corrupt the target JSON structure even when the API returns a failure status. The apply_patch() function in cJSON_Utils.c deletes existing target members before completing operation validation, meaning a malformed replace (missing value) or move (unresolvable destination) permanently destroys data from the in-memory document tree - defeating the RFC 6902 all-or-nothing contract that callers rely on to reject bad patches safely. No public exploit has been identified at time of analysis, but a detailed researcher disclosure and direct source code reference are publicly available, which may lower the barrier to exploitation; KEV status is not confirmed.

Denial of service in the cJSON C library (versions through 1.7.19) arises from exponential algorithmic complexity in the cJSON_Compare() function, which recursively descends into each shared object subtree twice per level with no depth guard. Applications that call cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document can be forced to burn hours of CPU on a document of only a few hundred bytes (nesting depth around 40), with cost roughly doubling per added level. No public exploit identified at time of analysis and the issue is not on CISA KEV; impact is compute exhaustion only, with no confidentiality or integrity effect.

Denial of service in cJSON (DaveGamble's C JSON parser) through version 1.7.19 lets a remote attacker crash any application that applies an untrusted RFC 6902 JSON Patch through cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). By combining add and copy operations that graft duplicated subtrees, an attacker inflates document nesting far beyond the parser's 1000-level limit, and the unbounded recursion in cJSON_Delete() (plus a permissive CJSON_CIRCULAR_LIMIT of 10000 in cJSON_Duplicate()) exhausts the thread stack. Reported by VulnCheck with a public technical write-up; there is no public exploit identified at time of analysis and it is not on CISA KEV.

Integer overflow in the print_string_ptr() function of the cJSON library on 32-bit platforms causes a heap buffer overflow when processing crafted JSON strings with approximately 858,993,460 control characters. Applications using cJSON_PrintBuffered() with a pre-allocated buffer are vulnerable, potentially leading to remote code execution, information disclosure, or denial of service. No public exploit or active exploitation has been identified at the time of analysis.

cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is called. Rated low severity (CVSS 2.9), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}. Rated low severity (CVSS 2.9), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.

cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service (DoS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.