CVE-2026-67216 Details
Description
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
A denial-of-service vulnerability has been identified in cJSON versions through 1.7.19, stemming from an inefficient algorithmic complexity in the cJSON_Compare() function. This function compares objects by recursively traversing shared subtrees twice, without a depth limit, leading to exponential runtime based on nesting depth. A small, deeply nested JSON document can cause significant CPU consumption, with the processing time increasing dramatically with each additional level of depth. Applications that use cJSON_Compare() on attacker-controlled JSON documents that are structurally identical to a reference document are vulnerable to this denial-of-service condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180 | [email protected] | Patch |
| https://joshua.hu/cjson-json-parser-cve-vulnerabilities | [email protected] | ExploitPress/Media CoverageThird Party Advisory |
| https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| davegamble cjson | <= 1.7.19 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | Initial Analysis | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | CVE Modified | [email protected] |
| Jul 29, 2026 | New CVE Received | [email protected] |