CVE-2026-67216

NameCVE-2026-67216
DescriptioncJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1143048

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cjson (PTS)bullseye1.7.14-1+deb11u1vulnerable
bullseye (security)1.7.14-1+deb11u3vulnerable
bookworm, bookworm (security)1.7.15-1+deb12u4vulnerable
trixie (security), trixie1.7.18-3.1+deb13u1vulnerable
forky, sid1.7.19-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cjsonsource(unstable)(unfixed)1143048

Notes

https://joshua.hu/cjson-json-parser-cve-vulnerabilities

Search for package or bug name: Reporting problems