Описание
A flaw was found in cJSON. An inefficient algorithmic complexity flaw in the cJSON_Compare() function allows a remote attacker to cause a denial of service (DoS). By providing specially crafted, deeply nested JSON (JavaScript Object Notation) objects for comparison, an attacker can consume excessive CPU resources, leading to the application becoming unresponsive for extended periods.
Отчет
While upstream sources rate this flaw as High impact (CVSSv4 8.2), Red Hat evaluates this issue as Moderate impact (CVSS 5.9). This reflects a higher Attack Complexity (AC:H) and an impact strictly isolated to Availability (A:H), with zero effect on Confidentiality or Integrity (C:N, I:N). Exploitation is narrowly constrained: an attacker cannot trigger resource exhaustion simply by submitting a deeply nested document to a standard JSON ingestion endpoint. The host application must explicitly pass the input into cJSON_Compare() against a structurally matching reference document. Applications that only parse, validate, or serialize JSON without invoking object equality comparisons are completely unaffected by this algorithmic complexity flaw. When triggered, the resulting exponential running time leads strictly to thread CPU starvation. It does not cause stack exhaustion crashes, memory corruption, or arbitrary code execution.
Меры по смягчению последствий
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | chunkah | Not affected | ||
| Red Hat Satellite 6 | cjson | Affected | ||
| Red Hat Satellite 6 | satellite:el8/cjson | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
cJSON through 1.7.19 contains an inefficient algorithmic complexity fl ...
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.
EPSS
5.9 Medium
CVSS3