{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67216", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-28T19:20:19.157Z", "datePublished": "2026-07-29T13:32:03.696Z", "dateUpdated": "2026-07-30T15:19:59.613Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-29T16:00:06.548Z"}, "title": "cJSON cJSON_Compare Exponential Complexity Denial of Service", "descriptions": [{"lang": "en", "value": "cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."}], "datePublic": "2026-07-25T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-407", "description": "Inefficient Algorithmic Complexity", "type": "CWE"}]}], "affected": [{"vendor": "DaveGamble", "product": "cJSON", "defaultStatus": "affected", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.19"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "references": [{"url": "https://joshua.hu/cjson-json-parser-cve-vulnerabilities", "tags": ["exploit"], "name": "Security vulnerabilities in the cJSON JSON parser (Joshua Rogers)"}, {"url": "https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180", "tags": ["technical-description"], "name": "cJSON_Compare double-recursion object comparison (cJSON.c)"}, {"name": "VulnCheck Advisory: cJSON cJSON_Compare Exponential Complexity Denial of Service", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T13:38:48.858891Z", "id": "CVE-2026-67216", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T15:19:59.613Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67216", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T13:38:48.858891Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T13:38:54.112Z"}}], "cna": {"title": "cJSON cJSON_Compare Exponential Complexity Denial of Service", "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "DaveGamble", "product": "cJSON", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.19"}], "defaultStatus": "affected"}], "datePublic": "2026-07-25T00:00:00.000Z", "references": [{"url": "https://joshua.hu/cjson-json-parser-cve-vulnerabilities", "name": "Security vulnerabilities in the cJSON JSON parser (Joshua Rogers)", "tags": ["exploit"]}, {"url": "https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180", "name": "cJSON_Compare double-recursion object comparison (cJSON.c)", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service", "name": "VulnCheck Advisory: cJSON cJSON_Compare Exponential Complexity Denial of Service", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "Inefficient Algorithmic Complexity"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:davegamble:cjson:*:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-29T16:00:06.548Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67216", "state": "PUBLISHED", "dateUpdated": "2026-07-30T15:19:59.613Z", "dateReserved": "2026-07-28T19:20:19.157Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-29T13:32:03.696Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "cJSON: Denial of Service due to inefficient JSON object comparison", "id": "2508418", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508418"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in cJSON. An inefficient algorithmic complexity flaw in the `cJSON_Compare()` function allows a remote attacker to cause a denial of service (DoS). By providing specially crafted, deeply nested JSON (JavaScript Object Notation) objects for comparison, an attacker can consume excessive CPU resources, leading to the application becoming unresponsive for extended periods."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2026-67216", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "chunkah", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "cjson", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "satellite:el8/cjson", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-07-29T13:32:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-67216\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67216\nhttps://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180\nhttps://joshua.hu/cjson-json-parser-cve-vulnerabilities\nhttps://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service"], "statement": "While upstream sources rate this flaw as High impact (CVSSv4 8.2), Red Hat evaluates this issue as Moderate impact (CVSS 5.9). This reflects a higher Attack Complexity (AC:H) and an impact strictly isolated to Availability (A:H), with zero effect on Confidentiality or Integrity (C:N, I:N).\nExploitation is narrowly constrained: an attacker cannot trigger resource exhaustion simply by submitting a deeply nested document to a standard JSON ingestion endpoint. The host application must explicitly pass the input into cJSON_Compare() against a structurally matching reference document. Applications that only parse, validate, or serialize JSON without invoking object equality comparisons are completely unaffected by this algorithmic complexity flaw.\nWhen triggered, the resulting exponential running time leads strictly to thread CPU starvation. It does not cause stack exhaustion crashes, memory corruption, or arbitrary code execution.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.19]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "cJSON", "source": "cna", "vendor": "DaveGamble"}, "product": "cjson", "vendor": "davegamble"}], "created": "2026-07-29T15:45:03.852178+00:00", "updated": "2026-07-29T15:45:03.852199+00:00", "vendors": ["davegamble", "davegamble$PRODUCT$cjson"]}