Executive brief
lwjson is a lightweight JSON library commonly used in embedded systems to process data. A flaw in how it handles specific text sequences allows a remote attacker to send a specially crafted message that causes the system to hang indefinitely. This results in a denial-of-service (DoS) condition, potentially making the affected device or application unresponsive.
Technical details
An infinite loop vulnerability (CWE-835) exists in lwjson_stream.c due to flawed end-of-string detection logic. The parser incorrectly identifies escaped quote characters by only checking the single immediately preceding character rather than counting consecutive backslashes. When a valid JSON string ends with an escaped backslash (e.g., \"\\\\\"), the parser fails to recognize the closing quote as a terminator and continues to wait for more input. A remote attacker can exploit this by sending well-formed JSON that causes the lwjson_stream_parse() function to hang, resulting in a denial of service. The vulnerability affects version 1.8.1 and earlier.
Affected products
- MaJerle lwjson Up to and including 1.8.1
Timeline
- 2026-03-18: disclosed: Vulnerability details shared via GitHub Gist by David Williams.
- 2026-05-08: advisory: CVE-2026-29975 published.