CVE-2026-67216

Name
CVE-2026-67216
Description
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180
disclosure@vulncheck.com https://joshua.hu/cjson-json-parser-cve-vulnerabilities
disclosure@vulncheck.com https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:* cjson >= None <= 1.7.19

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
cjson edge-main 1.7.19-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson edge-main 1.7.19-r0 None possibly vulnerable
cjson edge-main 1.7.18-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson edge-main 1.7.18-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson edge-main 1.7.17-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.24-main 1.7.19-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.23-main 1.7.19-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.22-main 1.7.19-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.22-main 1.7.18-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.22-main 1.7.17-r0 None possibly vulnerable
cjson 3.21-main 1.7.19-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.21-main 1.7.18-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.21-main 1.7.17-r0 None possibly vulnerable
cjson 3.20-main 1.7.19-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.20-main 1.7.18-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.20-main 1.7.17-r0 None possibly vulnerable
cjson 3.19-main 1.7.19-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
cjson 3.19-main 1.7.17-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable