CVE-2026-29975 Details
Description
lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson_stream.c). The end-of-string detection logic incorrectly identifies escaped quote characters by only checking the immediately preceding character rather than counting consecutive backslashes, causing valid JSON strings ending with an escaped backslash (like "\\") to never terminate parsing. A remote attacker can send well-formed JSON to cause applications using lwjson_stream_parse() to hang indefinitely, resulting in denial of service.
A denial-of-service vulnerability has been identified in lwjson version 1.8.1, specifically within the streaming JSON parser component. The issue arises from improper input validation in the end-of-string detection logic, which fails to correctly interpret escaped quote characters. This flaw allows valid JSON strings that end with an escaped backslash to be mismanaged, causing applications that utilize the lwjson_stream_parse() function to hang indefinitely. As a result, this vulnerability can be exploited by remote attackers who send well-formed JSON payloads that trigger this parsing error, leading to a persistent application freeze.
Users can update to lwjson version 1.8.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/dwilliams27/b99fd41be5d6848691797042cbfc1103 | CISA-ADP | ExploitTechnical Description |
| https://gist.github.com/dwilliams27/b99fd41be5d6848691797042cbfc1103 | [email protected] | ExploitTechnical Description |
| https://github.com/MaJerle/lwjson/blob/develop/lwjson/src/lwjson/lwjson_stream.c#L362-L364 | [email protected] | Source CodeVendor |
| https://github.com/MaJerle/lwjson/tree/develop | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| MaJerle lwjson | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |