Loading story…
A high-severity denial-of-service vulnerability, CVE-2026-67215, has been disclosed in DaveGamble cJSON through version 1.7.19. The flaw affects applications that process untrusted RFC 6902 JSON Patch input with cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(), where crafted add and copy operations can duplicate subtrees and drive document depth far beyond expected limits.
The crash occurs because cJSON_Delete() can recurse without a depth bound, leading to stack exhaustion. Advisory details note that CJSON_CIRCULAR_LIMIT is set to 10000, substantially higher than the parser's roughly 1000-level nesting limit, creating a path for remote attackers with no privileges or user interaction to terminate affected processes. The issue is tracked as CWE-674 and carries a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting high availability impact.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
The CVE entry states that disclosure@vulncheck.com newly received CVE-2026-67215 on July 29, 2026. The vulnerability affects cJSON through version 1.7.19 and can cause denial of service via uncontrolled recursion and stack exhaustion when processing crafted JSON Patch input.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public disclosure detailed **33 vulnerabilities** in the widely used C JSON library **cJSON**, affecting versions through **`1.7.19`** and prompting warnings for organizations that parse attacker-controlled JSON. The reported issues include memory-safety bugs, denial-of-service conditions, and logic flaws that can cause **silent data loss** or operations on the wrong object member. An `oss-sec` post said some of the problems had previously been reported with proof-of-concept code and unmerged fixes, while the library's development was described as largely stagnant. One of the tracked issues, **`CVE-2026-67216`**, is a **CWE-407** algorithmic complexity flaw in **`cJSON_Compare()`** that can be exploited for remote CPU exhaustion. The vulnerable function recursively traverses shared JSON subtrees twice without a depth guard, causing comparison time to grow exponentially with nesting depth; a small but deeply nested JSON document can therefore tie up a system for hours. Advisories recommend upgrading to a patched release when available, avoiding `cJSON_Compare()` on deeply nested input, validating JSON structure before comparison, and assessing whether cJSON should be replaced in exposed applications.
Aug 1, 2026
CERT Polska disclosed **CVE-2026-16554**, an integer overflow vulnerability in the DaveGamble **cJSON** library that can lead to a heap buffer overflow on 32-bit platforms. The flaw affects confirmed version **1.7.19** and occurs in the `print_string_ptr()` function in `cJSON.c`, where the 32-bit `size_t` `escape_characters` counter can wrap while processing extremely large JSON strings containing roughly **858,993,460** or more control characters. If an application uses `cJSON_PrintBuffered()` with a pre-allocated buffer, the integer wrap can cause the library to underestimate the required allocation before entering the write loop, creating conditions for memory corruption. CERT Polska said a crafted JSON string supplied to software using cJSON could enable **remote code execution**, **information disclosure**, or **denial of service**; the group coordinated disclosure but said vendor contact attempts were unsuccessful, and only version **1.7.19** has been confirmed vulnerable so far, though other versions may also be affected.
Jul 27, 2026
A high-severity denial-of-service flaw tracked as **`CVE-2026-71847`** was disclosed in the Ruby `json` package, affecting versions **`2.20.0` through before `2.21.2`**. The bug resides in the native C extension behind **`JSON::ResumableParser`**, where truncated streaming JSON containing duplicate object keys can cause the parser to clear its input buffer while leaving stale internal pointers behind, creating a **heap-use-after-free** condition classified as **`CWE-416`**. If an application accepts attacker-controlled JSON streams and later calls **`partial_value`** on the incomplete input, the parser can perform pointer operations on freed memory in its warning-handling path and crash the Ruby worker process. The issue impacts availability rather than confidentiality or integrity, and the fix in **`json` `2.21.2`** clears the freed buffer, nullifies parser state pointers, and adjusts warning generation logic to avoid cursor calculations when parser state is still present.
Aug 8, 2026