Is CVE-2026-67216 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67216 being exploited in the wild.

How severe is CVE-2026-67216?

Medium severity, with a CVSS score of 5.9, published 29 July 2026.

Which products and versions are affected?

DaveGamble cJSON through 1.7.19.

Is there a fix for CVE-2026-67216?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-67216 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67216?

Check whether you run DaveGamble cJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67216: DaveGamble cJSON denial of service in cJSON_Compare

CVE-2026-67216 · Severity: medium · CVSS 5.9 · Published 2026-07-29

cJSON is a widely used library for parsing and managing JSON data in C-based applications, including embedded firmware and server-side software. A flaw in how the library compares two JSON objects allows an attacker to provide a specially crafted, deeply nested document that causes the system to consume excessive processor power. This can lead to a denial-of-service (DoS) condition where the application becomes unresponsive for hours while attempting to process a small amount of data.

Technologies: DaveGamble cJSON. Vendors: DaveGamble.

Quick answers

Is CVE-2026-67216 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67216 being exploited in the wild.
How severe is CVE-2026-67216?: Medium severity, with a CVSS score of 5.9, published 29 July 2026.
Which products and versions are affected?: DaveGamble cJSON through 1.7.19.
Is there a fix for CVE-2026-67216?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-67216 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67216?: Check whether you run DaveGamble cJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An inefficient algorithmic complexity vulnerability (CWE-407) exists in the cJSON_Compare() function of cJSON through version 1.7.19. When comparing two JSON objects, the function recurses into each shared subtree twice (once in each direction) without a depth guard. This results in exponential time complexity relative to the nesting depth. An attacker can exploit this by providing a small, deeply nested JSON document (e.g., ~40 levels deep) that is structurally equal to a reference document, causing the CPU to hang for hours. The vulnerability is reachable over the network if the application performs equality checks on attacker-controlled JSON input. No patch is currently available as development of the library has been largely stagnant.

Affected products

DaveGamble cJSON through 1.7.19

Timeline

2026-07-29: advisory: Vulnerability disclosed by Joshua Rogers and VulnCheck

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.