Loading story…
CERT Polska disclosed CVE-2026-16554, an integer overflow vulnerability in the DaveGamble cJSON library that can lead to a heap buffer overflow on 32-bit platforms. The flaw affects confirmed version 1.7.19 and occurs in the print_string_ptr() function in cJSON.c, where the 32-bit size_t escape_characters counter can wrap while processing extremely large JSON strings containing roughly 858,993,460 or more control characters.
If an application uses cJSON_PrintBuffered() with a pre-allocated buffer, the integer wrap can cause the library to underestimate the required allocation before entering the write loop, creating conditions for memory corruption. CERT Polska said a crafted JSON string supplied to software using cJSON could enable remote code execution, information disclosure, or denial of service; the group coordinated disclosure but said vendor contact attempts were unsuccessful, and only version 1.7.19 has been confirmed vulnerable so far, though other versions may also be affected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska disclosed CVE-2026-16554, an integer overflow in the DaveGamble cJSON library affecting confirmed version 1.7.19 on 32-bit platforms. The flaw can lead to heap buffer overflow during cJSON_PrintBuffered() processing of crafted large strings, with possible remote code execution, information disclosure, or denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public disclosure detailed **33 vulnerabilities** in the widely used C JSON library **cJSON**, affecting versions through **`1.7.19`** and prompting warnings for organizations that parse attacker-controlled JSON. The reported issues include memory-safety bugs, denial-of-service conditions, and logic flaws that can cause **silent data loss** or operations on the wrong object member. An `oss-sec` post said some of the problems had previously been reported with proof-of-concept code and unmerged fixes, while the library's development was described as largely stagnant. One of the tracked issues, **`CVE-2026-67216`**, is a **CWE-407** algorithmic complexity flaw in **`cJSON_Compare()`** that can be exploited for remote CPU exhaustion. The vulnerable function recursively traverses shared JSON subtrees twice without a depth guard, causing comparison time to grow exponentially with nesting depth; a small but deeply nested JSON document can therefore tie up a system for hours. Advisories recommend upgrading to a patched release when available, avoiding `cJSON_Compare()` on deeply nested input, validating JSON structure before comparison, and assessing whether cJSON should be replaced in exposed applications.
Aug 1, 2026
A high-severity denial-of-service vulnerability, **CVE-2026-67215**, has been disclosed in **DaveGamble cJSON** through version `1.7.19`. The flaw affects applications that process untrusted **RFC 6902 JSON Patch** input with `cJSONUtils_ApplyPatches()` or `cJSONUtils_ApplyPatchesCaseSensitive()`, where crafted `add` and `copy` operations can duplicate subtrees and drive document depth far beyond expected limits. The crash occurs because `cJSON_Delete()` can recurse without a depth bound, leading to stack exhaustion. Advisory details note that `CJSON_CIRCULAR_LIMIT` is set to `10000`, substantially higher than the parser's roughly `1000`-level nesting limit, creating a path for remote attackers with no privileges or user interaction to terminate affected processes. The issue is tracked as **CWE-674** and carries a **CVSS v3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, reflecting high availability impact.
Jul 29, 2026
A high-severity denial-of-service flaw tracked as **`CVE-2026-71847`** was disclosed in the Ruby `json` package, affecting versions **`2.20.0` through before `2.21.2`**. The bug resides in the native C extension behind **`JSON::ResumableParser`**, where truncated streaming JSON containing duplicate object keys can cause the parser to clear its input buffer while leaving stale internal pointers behind, creating a **heap-use-after-free** condition classified as **`CWE-416`**. If an application accepts attacker-controlled JSON streams and later calls **`partial_value`** on the incomplete input, the parser can perform pointer operations on freed memory in its warning-handling path and crash the Ruby worker process. The issue impacts availability rather than confidentiality or integrity, and the fix in **`json` `2.21.2`** clears the freed buffer, nullifies parser state pointers, and adjusts warning generation logic to avoid cursor calculations when parser state is still present.
Aug 8, 2026