CVE-2023-26819: Low severity cJSON cJSON vulnerability
Published Apr 19, 2025
·Updated
cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.
Affected Software
6 affected componentsFixes available
cJSON cJSON
Cjson Project Cjson=1.7.15
Microsoft azl3 ceph 18.2.2-11
Microsoft azl3 libglvnd 1.7.0-3
Microsoft azl3 ceph 18.2.2-12
Microsoft azl3 ceph 18.2.2-10
Event History
Apr 19, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Aug 7, 2025
Data Sourced
via Microsoft·12:00 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·12:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2023-26819?
CVE-2023-26819 is categorized as a denial-of-service vulnerability.
2
How do I fix CVE-2023-26819?
To fix CVE-2023-26819, upgrade to a patched version of cJSON that addresses this vulnerability.
3
What kind of attack does CVE-2023-26819 enable?
CVE-2023-26819 enables denial-of-service attacks through crafted JSON documents.
4
Which versions of cJSON are affected by CVE-2023-26819?
CVE-2023-26819 affects cJSON version 1.7.15 and possibly earlier versions.
5
What causes the vulnerability in CVE-2023-26819?
The vulnerability in CVE-2023-26819 is caused by improper handling of large numeric values in JSON documents.