# CVE-2026-67216: DaveGamble cJSON denial of service in cJSON_Compare

Source: https://junglewise.ai/threats/cve-2026-67216-davegamble-cjson-denial-of-service-in-cjson-compare  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-67216 · Severity: medium · CVSS 5.9 · Published 2026-07-29

cJSON is a widely used library for parsing and managing JSON data in C-based applications, including embedded firmware and server-side software. A flaw in how the library compares two JSON objects allows an attacker to provide a specially crafted, deeply nested document that causes the system to consume excessive processor power. This can lead to a denial-of-service (DoS) condition where the application becomes unresponsive for hours while attempting to process a small amount of data.

Technologies: [DaveGamble cJSON](https://junglewise.ai/threats/technologies/cjson). Vendors: [DaveGamble](https://junglewise.ai/threats/vendors/davegamble).

## Quick answers

**Is CVE-2026-67216 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67216 being exploited in the wild.

**How severe is CVE-2026-67216?** Medium severity, with a CVSS score of 5.9, published 29 July 2026.

**Which products and versions are affected?** DaveGamble cJSON through 1.7.19.

**Is there a fix for CVE-2026-67216?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67216 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67216?** Check whether you run DaveGamble cJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An inefficient algorithmic complexity vulnerability (CWE-407) exists in the cJSON_Compare() function of cJSON through version 1.7.19. When comparing two JSON objects, the function recurses into each shared subtree twice (once in each direction) without a depth guard. This results in exponential time complexity relative to the nesting depth. An attacker can exploit this by providing a small, deeply nested JSON document (e.g., ~40 levels deep) that is structurally equal to a reference document, causing the CPU to hang for hours. The vulnerability is reachable over the network if the application performs equality checks on attacker-controlled JSON input. No patch is currently available as development of the library has been largely stagnant.

## Affected products

- DaveGamble cJSON through 1.7.19

## Timeline

- 2026-07-29: advisory: Vulnerability disclosed by Joshua Rogers and VulnCheck

## References

- [https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c](https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c)
- [https://joshua.hu/cjson-json-parser-cve-vulnerabilities](https://joshua.hu/cjson-json-parser-cve-vulnerabilities)
- [https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service](https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service)

## Related threats

- [cJSON use-after-free in MergePatch](https://junglewise.ai/threats/cve-2026-87933-cjson-use-after-free-in-mergepatch)
- [cJSON JSON Pointer escape sequence bypass in decode_pointer_inplace()](https://junglewise.ai/threats/cve-2026-29036-cjson-json-pointer-escape-sequence-bypass-in-decode-pointer)
- [DaveGamble cJSON non-atomic JSON Patch application in cJSON_Utils.c](https://junglewise.ai/threats/cve-2026-67217-davegamble-cjson-non-atomic-json-patch-application-in-cjson-utils)
- [DaveGamble cJSON uncontrolled recursion in cJSONUtils_ApplyPatches](https://junglewise.ai/threats/cve-2026-67215-davegamble-cjson-uncontrolled-recursion-in-cjsonutils)
- [DaveGamble cJSON integer overflow in print_string_ptr](https://junglewise.ai/threats/cve-2026-16554-davegamble-cjson-integer-overflow-in-print-string-ptr)