Loading story…
A public disclosure detailed 33 vulnerabilities in the widely used C JSON library cJSON, affecting versions through 1.7.19 and prompting warnings for organizations that parse attacker-controlled JSON. The reported issues include memory-safety bugs, denial-of-service conditions, and logic flaws that can cause silent data loss or operations on the wrong object member. An oss-sec post said some of the problems had previously been reported with proof-of-concept code and unmerged fixes, while the library's development was described as largely stagnant.
One of the tracked issues, CVE-2026-67216, is a CWE-407 algorithmic complexity flaw in cJSON_Compare() that can be exploited for remote CPU exhaustion. The vulnerable function recursively traverses shared JSON subtrees twice without a depth guard, causing comparison time to grow exponentially with nesting depth; a small but deeply nested JSON document can therefore tie up a system for hours. Advisories recommend upgrading to a patched release when available, avoiding cJSON_Compare() on deeply nested input, validating JSON structure before comparison, and assessing whether cJSON should be replaced in exposed applications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
An oss-sec mailing list post highlighted the public writeup about 33 cJSON vulnerabilities and warned organizations to assess replacing the library where attacker-controlled JSON is parsed. The post also noted that CVE-2026-67215, CVE-2026-67216, and CVE-2026-67217 reference the disclosed writeup.
CVE-2026-67216 was published for an exponential-complexity denial-of-service vulnerability in cJSON through version 1.7.19. The flaw stems from inefficient recursive traversal in cJSON_Compare(), allowing deeply nested JSON comparisons to consume excessive CPU time.
A public writeup reported 33 security issues in the cJSON library affecting versions up to and including 1.7.19. The disclosure said the first 13 issues included memory-safety and denial-of-service flaws, while the rest were logic bugs that could cause silent data loss or operations on the wrong object member.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcecvefeed.io
Open sourcejoshua.hu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity denial-of-service vulnerability, **CVE-2026-67215**, has been disclosed in **DaveGamble cJSON** through version `1.7.19`. The flaw affects applications that process untrusted **RFC 6902 JSON Patch** input with `cJSONUtils_ApplyPatches()` or `cJSONUtils_ApplyPatchesCaseSensitive()`, where crafted `add` and `copy` operations can duplicate subtrees and drive document depth far beyond expected limits. The crash occurs because `cJSON_Delete()` can recurse without a depth bound, leading to stack exhaustion. Advisory details note that `CJSON_CIRCULAR_LIMIT` is set to `10000`, substantially higher than the parser's roughly `1000`-level nesting limit, creating a path for remote attackers with no privileges or user interaction to terminate affected processes. The issue is tracked as **CWE-674** and carries a **CVSS v3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, reflecting high availability impact.
Jul 29, 2026
CERT Polska disclosed **CVE-2026-16554**, an integer overflow vulnerability in the DaveGamble **cJSON** library that can lead to a heap buffer overflow on 32-bit platforms. The flaw affects confirmed version **1.7.19** and occurs in the `print_string_ptr()` function in `cJSON.c`, where the 32-bit `size_t` `escape_characters` counter can wrap while processing extremely large JSON strings containing roughly **858,993,460** or more control characters. If an application uses `cJSON_PrintBuffered()` with a pre-allocated buffer, the integer wrap can cause the library to underestimate the required allocation before entering the write loop, creating conditions for memory corruption. CERT Polska said a crafted JSON string supplied to software using cJSON could enable **remote code execution**, **information disclosure**, or **denial of service**; the group coordinated disclosure but said vendor contact attempts were unsuccessful, and only version **1.7.19** has been confirmed vulnerable so far, though other versions may also be affected.
Jul 27, 2026
A high-severity denial-of-service flaw tracked as **`CVE-2026-71847`** was disclosed in the Ruby `json` package, affecting versions **`2.20.0` through before `2.21.2`**. The bug resides in the native C extension behind **`JSON::ResumableParser`**, where truncated streaming JSON containing duplicate object keys can cause the parser to clear its input buffer while leaving stale internal pointers behind, creating a **heap-use-after-free** condition classified as **`CWE-416`**. If an application accepts attacker-controlled JSON streams and later calls **`partial_value`** on the incomplete input, the parser can perform pointer operations on freed memory in its warning-handling path and crash the Ruby worker process. The issue impacts availability rather than confidentiality or integrity, and the fix in **`json` `2.21.2`** clears the freed buffer, nullifies parser state pointers, and adjusts warning generation logic to avoid cursor calculations when parser state is still present.
Aug 8, 2026