Vulnerabilities

cJSON through version 1.7.19, DaveGamble's widely embedded open-source C JSON library, is vulnerable to uncontrolled recursion (CWE-674) that causes stack exhaustion and a process crash when an untrusted RFC 6902 JSON Patch document is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). The flaw arises because add and copy operations in a crafted patch graft duplicated subtrees, driving document depth far beyond the parser's 1000-level nesting limit, while cJSON_Delete() recurses with no depth bound and cJSON_Duplicate()'s CJSON_CIRCULAR_LIMIT guard of 10000 permits trees deep enough to overflow a default thread stack. An attacker who can supply the patch document gains denial of service only: the CVSS 4.0 base of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects high availability impact with no confidentiality or integrity loss. Any application, daemon, or embedded product that links or vendors cJSON up to 1.7.19 and applies attacker-controlled JSON Patch documents is affected; the CVE record lists only the davegamble/cjson product itself, so downstream consumers must be identified through dependency auditing. There is no confirmed in-the-wild exploitation (absent from CISA KEV, EPSS about 0.5%), but one public analysis with a proof-of-concept is available.

Do: Audit dependencies and vendored source trees for cJSON (forked copies are common given its single-file MIT distribution) and determine whether cJSONUtils_ApplyPatches()/cJSONUtils_ApplyPatchesCaseSensitive() ever processes untrusted input; no fixed release is stated in the available data, so track the upstream DaveGamble/cJSON repository for a patched version beyond 1.7.19 and upgrade when one is published. As an interim mitigation, cap patch document depth and operation counts well below the parser's 1000-level nesting limit before applying patches, and/or run JSON Patch processing in an isolated worker process so a stack-overflow crash does not take down the host service.

cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.