CVE-2026-116011Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

Beschreibung

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-7x84-xhp8-6cqj) vendor-advisory
• https://github.com/CrowCpp/Crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b patch
• Crow v1.3.4 Release Notes release-notes
• https://github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878 technical-description
• VulnCheck Advisory: Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load() third-party-advisory