CVE-2026-67216 in cJSON
Summary
by MITRE • 07/29/2026
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in cJSON versions through 1.7.19 represents a critical algorithmic complexity flaw that manifests in the cJSON_Compare() function, creating a severe denial-of-service risk for applications processing JSON data. This issue stems from an inefficient recursive implementation where the comparison algorithm traverses shared subtrees twice in opposite directions without any depth limitations or guards. The flaw operates at the core of how the library handles structural equality checks between JSON objects, fundamentally undermining performance characteristics under normal operational conditions.
The technical implementation of this vulnerability demonstrates poor algorithmic design principles that align with CWE-400, specifically addressing excessive computation complexity and lack of input validation for recursive operations. When an attacker provides a deeply nested JSON document that is structurally equivalent to a reference object, the function's exponential time complexity causes dramatic performance degradation. The mathematical progression of this flaw shows that processing time roughly doubles with each additional level of nesting, making what should be a trivial comparison operation become computationally infeasible at relatively modest depths.
The operational impact of this vulnerability extends beyond simple performance degradation to create meaningful denial-of-service conditions that can severely disrupt application functionality. An attacker can craft JSON payloads with nesting depths around 40 levels that cause applications using cJSON_Compare() to consume hours of CPU time, effectively rendering the system unresponsive to legitimate requests. This vulnerability directly maps to ATT&CK technique T1499.004, which covers network denial-of-service attacks through resource exhaustion, particularly focusing on computational resources rather than bandwidth or memory consumption.
Applications that incorporate cJSON_Compare() into their processing pipelines become particularly vulnerable when handling user-provided JSON data without proper validation or sanitization. The exponential time complexity makes this attack vector especially dangerous because the computational cost grows rapidly with minimal input changes, allowing attackers to create payloads that consume significant system resources with relatively small data sizes measured in hundreds of bytes. This characteristic transforms what appears to be a simple comparison operation into a potential systemic threat against service availability and resource management.
Mitigation strategies for this vulnerability require both immediate code-level fixes and architectural considerations for applications using the affected library versions. The most effective approach involves upgrading to cJSON version 1.7.20 or later, which contains the necessary algorithmic improvements to prevent exponential time complexity behavior. Organizations should also implement input validation measures that limit nesting depth in JSON processing pipelines, particularly when handling untrusted data sources. Additionally, system administrators should consider implementing resource limits and timeouts for JSON processing operations to prevent complete service exhaustion even if the underlying library vulnerability remains unpatched. The fix addresses the core algorithmic design flaw by introducing proper recursion depth guards and optimizing the comparison logic to avoid redundant subtree traversals that were causing the exponential performance degradation.