Inefficient Algorithmic Complexity Issue in cJSON Product by Dave Gamble

CVE-2026-67216

What is CVE-2026-67216?

cJSON versions up to and including 1.7.19 are susceptible to a significant algorithmic complexity vulnerability within the cJSON_Compare() function. This vulnerability arises when comparing JSON objects, leading to a scenario where recursive comparisons are performed multiple times without adequate depth control. The exploitation of this flaw can result in excessive CPU usage for certain JSON structures, particularly those that are deeply nested. When cJSON_Compare() is invoked on JSON documents that are influenced by an attacker and structurally equal to a reference document, the application may experience prolonged processing times, effectively resulting in a denial-of-service condition.

References