Vulnerabilities

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON.

All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values.

HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used.

HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB.

Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h.

This affects the package Crow before 0.3+4.

This affects the package Crow before 0.3+4.