CVE-2026-116011 in Crow
Summary
by MITRE • 10/24/2026
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in Crow web framework versions prior to 1.3.4 represents a critical uncontrolled recursion flaw within the json::load() function responsible for parsing incoming JSON payloads. This issue stems from insufficient validation of input depth during the recursive descent into nested data structures. When an attacker submits a request containing deeply nested objects, such as thousands of layers of empty or simple key-value pairs, the parser attempts to process each level by invoking itself recursively rather than using an iterative approach with explicit stack management. Because C++ typically relies on the operating system's call stack for recursive function calls, this unbounded recursion rapidly consumes available stack memory allocated to the worker thread handling the request.
From a technical perspective, this flaw is classified under CWE-675: Use of Automatically-Allocated Heap Data Structures for Uncontrolled Recursion or more broadly as CWE-400: Uncontrolled Resource Consumption. The recursive nature of standard JSON parsers in many C++ libraries makes them susceptible to stack overflow attacks when input depth is not strictly limited by the application developer. In the context of Crow, which utilizes a multi-threaded architecture where each connection may be handled by a dedicated worker thread or shared among a pool, exhausting the stack space of one thread can lead to an immediate crash of that specific process instance. This behavior aligns with ATT&CK technique T1496: Resource Hijacking, specifically resource exhaustion via denial-of-service mechanisms targeting application availability rather than confidentiality or integrity.
The operational impact of this vulnerability is severe in terms of service availability. Since the stack overflow causes an immediate termination of the worker process, all active connections handled by that specific instance are abruptly dropped. In a production environment running multiple instances behind a load balancer, while not every single request will crash the entire system if distributed correctly, it can still cause significant degradation and increased latency as remaining threads handle the redistributed traffic or as new processes restart to replace crashed ones. For applications relying on persistent connections or real-time data streams, this results in immediate session loss for connected clients. Furthermore, repeated exploitation attempts can lead to rapid resource exhaustion across all worker nodes if not mitigated at a higher network level, effectively rendering the service unavailable to legitimate users.
Mitigation strategies should focus primarily on upgrading to Crow version 1.3.4 or later, where this recursion limit has been addressed through improved parsing logic that likely implements iterative processing or explicit depth checking before recursive calls. For environments unable to upgrade immediately, implementing a Web Application Firewall (WAF) rule to inspect and reject JSON payloads exceeding a specific nesting depth is recommended. Additionally, application-level input validation should enforce strict limits on the complexity of incoming requests, ensuring that only expected data structures are processed. Network-level rate limiting can also help mitigate the impact by preventing any single source from flooding the server with maliciously crafted requests designed to trigger stack exhaustion.