CyberRota Analysis
AI-GeneratedThe cJSON library, up to version 1.7.19, is vulnerable to a denial-of-service condition due to an inefficient algorithmic complexity flaw in the cJSON_Compare() function, which can lead to excessive CPU consumption when comparing deeply nested JSON objects. This vulnerability can be exploited by an attacker through specially crafted JSON input, causing significant performance degradation in affected applications. Developers and organizations utilizing cJSON in their projects should prioritize addressing this issue to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
Related CVEs
Other vulnerabilities affecting the same vendor(s)