Executive brief
Gravity is a programming language runtime that includes a JSON parser component. A memory corruption vulnerability in the JSON parser allows remote attackers to cause application crashes or potentially execute arbitrary code by sending specially crafted JSON input. The vulnerability affects versions up to 0.9.7 and is fixed in version 0.9.8.
Technical details
A pointer-arithmetic overflow vulnerability exists in the json_parse_ex function within src/utils/gravity_json.c (CWE-119). The vulnerable code fails to properly validate buffer bounds, allowing the scan loop to advance past the allocated buffer end, resulting in memory corruption. The vulnerability is remotely exploitable without authentication and requires no user interaction beyond sending malformed JSON data. An attacker can trigger memory corruption leading to denial of service or potential code execution. The issue is patched in version 0.9.8 (commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2).
Affected products
- Marco Bambini Gravity up to 0.9.7
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Version 0.9.8 available