CVE-2026-90715: marcobambini Gravity udp json-parser gravity_json.c integer overflow
A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravityjson.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
marcobambini Gravity udp json-parser gravity_json.cto a version that resolves this vulnerability.Fixed in 0.9.8Patch 9b337c3eae5833c3956bed1fc01c21c14fd443f2
Event History
Frequently Asked Questions
Which deployments are affected?
Gravity versions up to and including 0.9.7 are affected in the udp json-parser component, specifically code in src/utils/gravity_json.c. Version 0.9.8 mitigates the issue.
Can this be exploited remotely without authentication or user interaction?
Yes. The supplied severity vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required.
Is public exploit information available?
Yes. The vulnerability description states that an exploit has been publicly disclosed and may be used.
What should be done if an affected version is in use?
Upgrade Gravity to version 0.9.8 or later. The identified patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2.