CVE-2026-67216

DaveGamble's cJSON through version 1.7.19 contains an inefficient algorithmic complexity flaw (CWE-407) in cJSON_Compare(): when comparing two objects, the function recurses into each shared subtree in both directions with no depth guard, so running time grows exponentially with nesting depth. An attacker can trigger this by supplying deeply nested JSON that is structurally equal to a reference document passed to cJSON_Compare(); a document of only a few hundred bytes at a nesting depth of roughly 40 consumes hours of CPU, with cost roughly doubling per additional level. The impact is a denial-of-service condition (CPU exhaustion), rated 8.2 (High) in CVSS 4.0 with high availability impact and no confidentiality or integrity impact. Any application built on cJSON at or below 1.7.19 that calls cJSON_Compare() on attacker-influenced JSON is affected, while deployments that never compare untrusted JSON with this function are not practically exposed. There is no known in-the-wild exploitation (not in CISA KEV), a single public proof-of-concept reference exists, and EPSS estimates only a 0.4% chance of exploitation in the next 30 days.

What to do: Audit whether your software calls cJSON_Compare() on untrusted or attacker-influenced JSON against a reference document; if so, upgrade to a cJSON release newer than 1.7.19 that adds a depth guard to the comparison routine (no fixed version number is specified in this advisory) or apply the upstream patch. As interim mitigation, reject untrusted JSON beyond a modest nesting depth before parsing and enforce CPU-time limits on affected request paths. Exploitation is currently only demonstrated by a public PoC, so patching can be prioritized alongside other high-severity network-triggered DoS issues.