# CVE-2026-90714: Gravity programming language memory corruption in JSON parser

Source: https://junglewise.ai/threats/cve-2026-90714-gravity-programming-language-memory-corruption-in-json-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90714 · Severity: medium · CVSS 6.3 · Published 2026-09-14

Gravity is a programming language runtime that includes a JSON parser component. A memory corruption vulnerability in the JSON parser allows remote attackers to cause application crashes or potentially execute arbitrary code by sending specially crafted JSON input. The vulnerability affects versions up to 0.9.7 and is fixed in version 0.9.8.

## Quick answers

**Is CVE-2026-90714 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90714 being exploited in the wild.

**How severe is CVE-2026-90714?** Medium severity, with a CVSS score of 6.3, published 14 September 2026.

**Which products and versions are affected?** Marco Bambini Gravity up to 0.9.7.

**Is there a fix for CVE-2026-90714?** A patch was published on 2026-09-14: Version 0.9.8 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90714 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-90714?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A pointer-arithmetic overflow vulnerability exists in the json_parse_ex function within src/utils/gravity_json.c (CWE-119). The vulnerable code fails to properly validate buffer bounds, allowing the scan loop to advance past the allocated buffer end, resulting in memory corruption. The vulnerability is remotely exploitable without authentication and requires no user interaction beyond sending malformed JSON data. An attacker can trigger memory corruption leading to denial of service or potential code execution. The issue is patched in version 0.9.8 (commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2).

## Affected products

- Marco Bambini Gravity up to 0.9.7

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Version 0.9.8 available

## References

- [https://github.com/marcobambini/gravity/](https://github.com/marcobambini/gravity/)
- [https://github.com/marcobambini/gravity/issues/448](https://github.com/marcobambini/gravity/issues/448)