CVE-2026-67216
CVE-2026-67216 is a medium-severity vulnerability in Davegamble Cjson with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-407.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- CVSS v4: 8.2
- EPSS exploit prediction: 0% (28th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-407
- Affected product: Davegamble Cjson
- Published:
- Last modified:
Description
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
Frequently asked questions
- What is CVE-2026-67216?
- cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
- How severe is CVE-2026-67216?
- CVE-2026-67216 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-67216 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-67216?
- CVE-2026-67216 affects Davegamble Cjson. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-67216?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-67216 published?
- CVE-2026-67216 was published on 2026-07-29 and last updated on 2026-08-04.
References
- https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180
- https://joshua.hu/cjson-json-parser-cve-vulnerabilities
- https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service
Affected products (1)
- cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*
More vulnerabilities in Davegamble Cjson
- CVE-2025-57052 — Critical (CVSS 9.8): cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in…
- CVE-2019-11835 — Critical (CVSS 9.8): cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.
- CVE-2019-11834 — Critical (CVSS 9.8): cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal.
- CVE-2016-10749 — Critical (CVSS 9.8): parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with…
- CVE-2018-1000217 — Critical (CVSS 9.8): Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can…
- CVE-2018-1000216 — High (CVSS 8.8): Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can…
All CVEs affecting Davegamble Cjson →
Other CWE-407 vulnerabilities
- CVE-2026-75596 — High (CVSS 8.7): Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the…
- CVE-2026-54284 — High (CVSS 8.7): sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion…
- CVE-2026-58059 — High (CVSS 8.7): In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue…
- CVE-2026-65623 — High (CVSS 8.7): Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via…
- CVE-2026-57480 — High (CVSS 8.7): Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to…
- CVE-2026-55206 — High (CVSS 8.7): py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and…