Products

Showing 5 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
DaveGamble vulnerability results
VulnerabilityTitle and contextCVSSEPSSPoCsSignalsSTIX action

cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corr

CWE-706Aug 11, 2026
CVSS8.7v4.0EPSS0.258%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch docume

CWE-696Jul 29, 2026
CVSS6.9v4.0EPSS0.25%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

cJSON cJSON_Compare Exponential Complexity Denial of Service

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on

CWE-407Jul 29, 2026
CVSS8.2v4.0EPSS0.351%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting l

CWE-674Jul 29, 2026
CVSS8.7v4.0EPSS0.38%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

Integer Overflow Leading to Heap Buffer Overflow in cJSON

cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted

CWE-190Jul 27, 2026
CVSS5.1v4.0EPSS0.295%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX