Vulnerabilities

cJSON through version 1.7.19, DaveGamble's widely embedded open-source C JSON library, is vulnerable to uncontrolled recursion (CWE-674) that causes stack exhaustion and a process crash when an untrusted RFC 6902 JSON Patch document is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). The flaw arises because add and copy operations in a crafted patch graft duplicated subtrees, driving document depth far beyond the parser's 1000-level nesting limit, while cJSON_Delete() recurses with no depth bound and cJSON_Duplicate()'s CJSON_CIRCULAR_LIMIT guard of 10000 permits trees deep enough to overflow a default thread stack. An attacker who can supply the patch document gains denial of service only: the CVSS 4.0 base of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects high availability impact with no confidentiality or integrity loss. Any application, daemon, or embedded product that links or vendors cJSON up to 1.7.19 and applies attacker-controlled JSON Patch documents is affected; the CVE record lists only the davegamble/cjson product itself, so downstream consumers must be identified through dependency auditing. There is no confirmed in-the-wild exploitation (absent from CISA KEV, EPSS about 0.5%), but one public analysis with a proof-of-concept is available.

Do: Audit dependencies and vendored source trees for cJSON (forked copies are common given its single-file MIT distribution) and determine whether cJSONUtils_ApplyPatches()/cJSONUtils_ApplyPatchesCaseSensitive() ever processes untrusted input; no fixed release is stated in the available data, so track the upstream DaveGamble/cJSON repository for a patched version beyond 1.7.19 and upgrade when one is published. As an interim mitigation, cap patch document depth and operation counts well below the parser's 1000-level nesting limit before applying patches, and/or run JSON Patch processing in an isolated worker process so a stack-overflow crash does not take down the host service.

cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.

cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.

parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character.

Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE. This attack appear to be exploitable via Depends on how application uses cJSON library. If application provides network interface then can be exploited over a network, otherwise just local.. This vulnerability appears to have been fixed in 1.7.4.