CVE-2026-116011: Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Crow versions before 1.3.4 are affected.
Does exploitation require authentication or user interaction?
No. A remote attacker can trigger the issue without authentication or user interaction by sending a maliciously deeply nested JSON request body.
What is the operational impact of a successful attack?
The nested JSON can exhaust a worker thread's stack and terminate the server process, dropping all connections. The reported impact is denial of service; confidentiality and integrity impacts are not listed.
What version resolves the issue?
Upgrade Crow to version 1.3.4 or later.