https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:25:11.567982+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-10702 bdu:2026-10702 2026-10-03T18:25:11.571437+00:00 bdu:2026-10702 https://cve.radiocsirt.org/vuln/euvd-2026-342433 EUVD-2026-342433 2026-10-03T18:25:11.571467+00:00 EUVD-2026-342433 https://cve.radiocsirt.org/vuln/fkie_cve-2026-67215 fkie_cve-2026-67215 2026-10-03T18:25:11.571481+00:00

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service.

 https://cve.radiocsirt.org/vuln/ghsa-5q3m-r3x7-8phg GHSA-5q3m-r3x7-8phg 2026-10-03T18:25:11.571514+00:00

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-67215 msrc_CVE-2026-67215 — cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion 2026-10-03T18:25:11.571534+00:00 msrc_CVE-2026-67215 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-67215 UBUNTU-CVE-2026-67215 2026-10-03T18:25:11.571549+00:00

Affected: Ubuntu:Pro:20.04:LTS: cjson, Ubuntu:Pro:22.04:LTS: cjson, Ubuntu:Pro:24.04:LTS: cjson, Ubuntu:26.04:LTS: cjson

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service.