Executive brief
cJSON is a widely used library for parsing and managing JSON data in C-based applications, including embedded firmware and server-side software. A flaw in how the library compares two JSON objects allows an attacker to provide a specially crafted, deeply nested document that causes the system to consume excessive processor power. This can lead to a denial-of-service (DoS) condition where the application becomes unresponsive for hours while attempting to process a small amount of data.
Technical details
An inefficient algorithmic complexity vulnerability (CWE-407) exists in the cJSON_Compare() function of cJSON through version 1.7.19. When comparing two JSON objects, the function recurses into each shared subtree twice (once in each direction) without a depth guard. This results in exponential time complexity relative to the nesting depth. An attacker can exploit this by providing a small, deeply nested JSON document (e.g., ~40 levels deep) that is structurally equal to a reference document, causing the CPU to hang for hours. The vulnerability is reachable over the network if the application performs equality checks on attacker-controlled JSON input. No patch is currently available as development of the library has been largely stagnant.
Affected products
- DaveGamble cJSON through 1.7.19
Timeline
- 2026-07-29: advisory: Vulnerability disclosed by Joshua Rogers and VulnCheck