CVE-2026-67215

Katalog CVE

CVSS 7.5 · High EPSS 0,70%

Kerentanan Uncontrolled Recursion pada davegamble cjson. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service.

Rincian

Terbit di NVD

29 Juli 2026

Terakhir diubah

4 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261 patch
• https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940 patch
• https://joshua.hu/cjson-json-parser-cve-vulnerabilities exploit · press/media coverage · advisory pihak ketiga
• https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion advisory pihak ketiga