Crow
Monthly
Unauthenticated remote attackers can terminate a Crow (CrowCpp) server process by sending an HTTP request body containing thousands of nested JSON objects to any route that passes the body to crow::json::load(). The recursive-descent parser in the Crow headers recursed without an effective depth guard, and a stack overflow is not catchable with try/catch, so the whole process dies and all open connections are dropped rather than a single request failing. The behavior is version-dependent on the deployment: the published PoC crashes a Windows build reliably with roughly 4000 nesting levels against a 1MB default stack, whereas Linux's ~8MB default stack resists the demonstrated depth, and a fronting reverse proxy that rejects oversized bodies prevents the attack. A public proof-of-concept (client and server source) accompanies the GitHub advisory; it is not independently verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. Vendor-released patch: 1.3.4.
All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthenticated remote attackers can terminate a Crow (CrowCpp) server process by sending an HTTP request body containing thousands of nested JSON objects to any route that passes the body to crow::json::load(). The recursive-descent parser in the Crow headers recursed without an effective depth guard, and a stack overflow is not catchable with try/catch, so the whole process dies and all open connections are dropped rather than a single request failing. The behavior is version-dependent on the deployment: the published PoC crashes a Windows build reliably with roughly 4000 nesting levels against a 1MB default stack, whereas Linux's ~8MB default stack resists the demonstrated depth, and a fronting reverse proxy that rejects oversized bodies prevents the attack. A public proof-of-concept (client and server source) accompanies the GitHub advisory; it is not independently verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. Vendor-released patch: 1.3.4.
All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.