parsestring in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSONParseWithLength is called.

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

cJSON v1.7.17 was discovered to contain a segmentation violation which can trigger through the second parameter of function cJSONSetValuestring at cJSON.c.

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.

cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal.

Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability

Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service

Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. This attack appear to be exploitable via Attacker must be able to force victim to print JSON data, depending on how cJSON library is used this could be either local or over a network. This vulnerability appears to have been fixed in 1.7.3.