CVE-2023-26819 describes a denial-of-service vulnerability in cJSON version 1.7.15, where a specially crafted JSON document containing a large number can cause the application to crash. This vulnerability has a low CVSS score of 2.9, indicating a low attack complexity and local access vector, with the primary impact being a denial of service. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.7.15CPE matchmatch criteria | cpe:2.3:a:cjson_project:cjson:1.7.15:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.
Aug 12, 2025cJSON: cJSON rejects a valid text
Apr 19, 2025cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.
Apr 8, 2025