CVE-2026-67216
published 2026-07-29CVE-2026-67216: cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.65%
50.3th percentile
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| davegamble | cjson | <= 1.7.19 | — |
| davegamble | cjson | — | — |
| satellite_el8 | cjson | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare().
ghsa_unreviewed·2026-07-29
CVE-2026-67216 [HIGH] CWE-407 cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare().
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
Red Hat
cJSON: Denial of Service due to inefficient JSON object comparison
vendor_redhat·2026-07-29·CVSS 5.9
CVE-2026-67216 [MEDIUM] CWE-770 cJSON: Denial of Service due to inefficient JSON object comparison
cJSON: Denial of Service due to inefficient JSON object comparison
A flaw was found in cJSON. An inefficient algorithmic complexity flaw in the `cJSON_Compare()` function allows a remote attacker to cause a denial of service (DoS). By providing specially crafted, deeply nested JSON (JavaScript Object Notation) objects for comparison, an attacker can consume excessive CPU resources, leading to the application becoming unresponsive for extended periods.
Statement: While upstream sources rate this flaw as High impact (CVSSv4 8.2), Red Hat evaluates this issue as Moderate impact (CVSS 5.9). This reflects a higher Attack Complexity (AC:H) and an impact strictly isolated to Availability (A:H), with zero effect on Confidentiality or Integrity (C:N, I:N).
Exploitation is narrowly constrained: an
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-67216 mmc: Denial of Service due to inefficient JSON object comparison [fedora-all]
bugzilla·2026-07-29·CVSS 5.9
CVE-2026-67216 [MEDIUM] CVE-2026-67216 mmc: Denial of Service due to inefficient JSON object comparison [fedora-all]
CVE-2026-67216 mmc: Denial of Service due to inefficient JSON object comparison [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls
Bugzilla
CVE-2026-67216 86box: Denial of Service due to inefficient JSON object comparison [fedora-all]
bugzilla·2026-07-29·CVSS 5.9
CVE-2026-67216 [MEDIUM] CVE-2026-67216 86box: Denial of Service due to inefficient JSON object comparison [fedora-all]
CVE-2026-67216 86box: Denial of Service due to inefficient JSON object comparison [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that cal
Bugzilla
CVE-2026-67216 dcm2niix: Denial of Service due to inefficient JSON object comparison [fedora-all]
bugzilla·2026-07-29·CVSS 5.9
CVE-2026-67216 [MEDIUM] CVE-2026-67216 dcm2niix: Denial of Service due to inefficient JSON object comparison [fedora-all]
CVE-2026-67216 dcm2niix: Denial of Service due to inefficient JSON object comparison [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that
Bugzilla
CVE-2026-67216 cjson: Denial of Service due to inefficient JSON object comparison [epel-all]
bugzilla·2026-07-29·CVSS 5.9
CVE-2026-67216 [MEDIUM] CVE-2026-67216 cjson: Denial of Service due to inefficient JSON object comparison [epel-all]
CVE-2026-67216 cjson: Denial of Service due to inefficient JSON object comparison [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls
Bugzilla
CVE-2026-67216 cjson: Denial of Service due to inefficient JSON object comparison [fedora-all]
bugzilla·2026-07-29·CVSS 5.9
CVE-2026-67216 [MEDIUM] CVE-2026-67216 cjson: Denial of Service due to inefficient JSON object comparison [fedora-all]
CVE-2026-67216 cjson: Denial of Service due to inefficient JSON object comparison [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that cal
Bugzilla
CVE-2026-67216 cJSON: Denial of Service due to inefficient JSON object comparison
bugzilla·2026-07-29·CVSS 5.9
CVE-2026-67216 [MEDIUM] CVE-2026-67216 cJSON: Denial of Service due to inefficient JSON object comparison
CVE-2026-67216 cJSON: Denial of Service due to inefficient JSON object comparison
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
2026-07-29
Published