Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-29T13:32:03 cJSON: Denial of Service due to inefficient JSON object comparison 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.

A flaw was found in cJSON. An inefficient algorithmic complexity flaw in the `cJSON_Compare()` function allows a remote attacker to cause a denial of service (DoS). By providing specially crafted, deeply nested JSON (JavaScript Object Notation) objects for comparison, an attacker can consume excessive CPU resources, leading to the application becoming unresponsive for extended periods.

While upstream sources rate this flaw as High impact (CVSSv4 8.2), Red Hat evaluates this issue as Moderate impact (CVSS 5.9). This reflects a higher Attack Complexity (AC:H) and an impact strictly isolated to Availability (A:H), with zero effect on Confidentiality or Integrity (C:N, I:N). Exploitation is narrowly constrained: an attacker cannot trigger resource exhaustion simply by submitting a deeply nested document to a standard JSON ingestion endpoint. The host application must explicitly pass the input into cJSON_Compare() against a structurally matching reference document. Applications that only parse, validate, or serialize JSON without invoking object equality comparisons are completely unaffected by this algorithmic complexity flaw. When triggered, the resulting exponential running time leads strictly to thread CPU starvation. It does not cause stack exhaustion crashes, memory corruption, or arbitrary code execution. Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Red Hat Hardened Images Not affected chunkah Red Hat Satellite 6 Affected cjson Red Hat Satellite 6 Affected satellite:el8/cjson https://www.cve.org/CVERecord?id=CVE-2026-67216 https://nvd.nist.gov/vuln/detail/CVE-2026-67216 https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L3057-L3180 https://joshua.hu/cjson-json-parser-cve-vulnerabilities https://www.vulncheck.com/advisories/cjson-cjson-compare-exponential-complexity-denial-of-service