Is CVE-2026-90715 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90715 being exploited in the wild.

How severe is CVE-2026-90715?

High severity, with a CVSS score of 7.3, published 14 September 2026.

Which products and versions are affected?

marcobambini Gravity up to 0.9.7.

Is there a fix for CVE-2026-90715?

A patch was published on 2026-09-14: Version 0.9.8 released with fix (commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90715 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90715?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90715: marcobambini Gravity integer overflow in JSON parser

CVE-2026-90715 · Severity: high · CVSS 7.3 · Published 2026-09-14

Gravity is a programming language runtime that includes a JSON parser for deserializing data. An integer overflow vulnerability in the JSON parser allows remote attackers to cause a denial of service (SIGILL crash) or data corruption by providing JSON input with excessively long digit sequences in numeric literals.

Quick answers

Is CVE-2026-90715 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90715 being exploited in the wild.
How severe is CVE-2026-90715?: High severity, with a CVSS score of 7.3, published 14 September 2026.
Which products and versions are affected?: marcobambini Gravity up to 0.9.7.
Is there a fix for CVE-2026-90715?: A patch was published on 2026-09-14: Version 0.9.8 released with fix (commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90715 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90715?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a signed 64-bit integer overflow (CWE-190) in the vendored udp json-parser component, specifically in the json_parse_ex function within src/utils/gravity_json.c at line 1126. The parser accumulates integer values digit-by-digit using the formula (accumulator * 10) + digit_value, which overflows when processing JSON integers with more than 19 significant decimal digits. The same unchecked pattern exists in the exponent accumulator. The integer overflow is undefined behavior in C and triggers SIGILL in sanitized builds, while non-sanitized builds may silently store corrupted values. Attack vectors include direct calls to json_parse() API and indirect calls through gravity_vm_loadbuffer() when deserializing untrusted compiled bytecode. The vulnerability was patched in version 0.9.8 (commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2).

Affected products

marcobambini Gravity up to 0.9.7

Timeline

2026-08-04: disclosed: Issue #447 opened on GitHub
2026-09-14: patched: Version 0.9.8 released with fix (commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2)
2026-09-14: advisory: CVE-2026-90715 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.