TI-2026-59997 CVE-2026-87933 · GHSA-7jcg-95pj-h5fp
DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
Priority HIGH 70
A vulnerability was found in DaveGamble cJSON up to 1.7.19.
Vulnerabilities
16 records
TI-2026-23183 CVE-2026-29036 · GHSA-89cr-7g9x-rjgw
cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding
Priority MEDIUM 44
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch…
TI-2026-47533 CVE-2026-67217 · GHSA-pr46-97qf-f32c
cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation
Priority HIGH 70
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c.
TI-2026-47532 CVE-2026-67216 · GHSA-ff2v-f99f-wm3f
cJSON cJSON_Compare Exponential Complexity Denial of Service
Priority HIGH 69
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare().
TI-2026-47531 CVE-2026-67215 · GHSA-5q3m-r3x7-8phg
cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion
Priority MEDIUM 45
cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive().
TI-2026-13812 CVE-2026-16554 · GHSA-qv6q-8g2j-w47g
Integer Overflow Leading to Heap Buffer Overflow in cJSON
Priority LOW 23
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms.
TI-2025-35424 CVE-2025-57052 · GHSA-98j5-4649-rfv2
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the…
Priority HIGH 82
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed…
TI-2023-27613 CVE-2023-50472 · GHSA-278h-99f9-m238
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.
Priority HIGH 72
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.
TI-2023-27612 CVE-2023-50471 · GHSA-xgc4-4vwx-6v94
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.
Priority LOW 36
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.
TI-2019-16034 CVE-2019-1010239 · GHSA-fqq7-vx9f-v496
NULL pointer dereference in DaveGamble/cJSON cJSON
Priority LOW 37
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions.
TI-2019-08871 CVE-2019-11835 · GHSA-3x2j-h977-v75r
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.
Priority MEDIUM 47
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.
TI-2019-08870 CVE-2019-11834 · GHSA-f8rc-mjx7-r7jf
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal.
Priority MEDIUM 47
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal.
TI-2016-08787 CVE-2016-10749 · GHSA-6q52-cg2r-w8jw
parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as…
Priority MEDIUM 47
parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character.
TI-2018-15863 CVE-2018-1000217 · GHSA-cmxj-54mf-j4q3
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free…
Priority MEDIUM 46
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE.
TI-2018-15862 CVE-2018-1000216 · GHSA-3g82-r8f2-r5vq
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability…
Priority MEDIUM 41
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE.
TI-2018-15861 CVE-2018-1000215 · GHSA-9xc3-9g76-hcvx
Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON…
Priority LOW 36
Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service (DoS).