Every CVE Search/ Get API key

CVE-2023-26819

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b":...

2.9 LowFix available

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.23%Up 0.2 points since Apr 20, 2025
90%50%10%1%

What each source reports

CVE List Score used 2.9

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Record
CVE-2023-26819
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-440
Updated
2026-11-02
EUVDEUVD-2023-30611 2.9

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Record
EUVD-2023-30611
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-whx8-2789-8w4w 2.9

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b":...

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Record
GHSA-whx8-2789-8w4w
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-440
Updated
2026-11-02
NVD 2.9

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Record
CVE-2023-26819
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-440
Updated
2026-11-02
OSV 2.9

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Record
CVE-2023-26819
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-440
Updated
2026-11-02
OSVDEBIAN-CVE-2023-26819 2.9

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Record
DEBIAN-CVE-2023-26819
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 12 moreShow less
OSVOESA-2025-1965 2.9

cjson security update

cJSON aims to be the dumbest possible parser that you can get your job done with. It's a single file of C, and a single header file. %package devel Summary: Development files for cJSON Requires: = - Requires: pkgconfig %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON. %prep %autosetup -n cJSON-

Security Fix(es):

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.(CVE-2023-26819)

Record
OESA-2025-1965
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1992 2.9

cjson security update

cJSON aims to be the dumbest possible parser that you can get your job done with. It's a single file of C, and a single header file. %package devel Summary: Development files for cJSON Requires: = - Requires: pkgconfig %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON. %prep %autosetup -n cJSON-

Security Fix(es):

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.(CVE-2023-26819)

Record
OESA-2025-1992
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1993 2.9

cjson security update

cJSON aims to be the dumbest possible parser that you can get your job done with. It's a single file of C, and a single header file. %package devel Summary: Development files for cJSON Requires: = - Requires: pkgconfig %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON. %prep %autosetup -n cJSON-

Security Fix(es):

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.(CVE-2023-26819)

Record
OESA-2025-1993
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1994 2.9

cjson security update

cJSON aims to be the dumbest possible parser that you can get your job done with. It's a single file of C, and a single header file. %package devel Summary: Development files for cJSON Requires: = - Requires: pkgconfig %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON. %prep %autosetup -n cJSON-

Security Fix(es):

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.(CVE-2023-26819)

Record
OESA-2025-1994
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1995 2.9

cjson security update

cJSON aims to be the dumbest possible parser that you can get your job done with. It's a single file of C, and a single header file. %package devel Summary: Development files for cJSON Requires: = - Requires: pkgconfig %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON. %prep %autosetup -n cJSON-

Security Fix(es):

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.(CVE-2023-26819)

Record
OESA-2025-1995
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2023-26819 2.9

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Record
UBUNTU-CVE-2023-26819
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-60883 No score

CVE-2023-26819 affecting package ceph 18.2.2-13

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Record
AZL-60883
Updated
2026-11-05
OSVAZL-60889 No score

CVE-2023-26819 affecting package libglvnd for versions less than 1.7.0-3

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]}.

Record
AZL-60889
Updated
2026-11-05
OSVopenSUSE-SU-2025:15583-1 No score

cJSON-devel-1.7.19-1.1 on GA media

These are all security issues fixed in the cJSON-devel-1.7.19-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15583-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20340-1 No score

Security update for cJSON

This update for cJSON fixes the following issues:

  • Update to version 1.7.19
    • Check for NULL in cJSON_DetachItemViaPointer.
    • Check overlap before calling strcpy in cJSON_SetValuestring.
    • Fix Max recursion depth for cJSON_Duplicate to prevent stack exhaustion.
    • Allocate memory for the temporary buffer when paring numbers. This fixes CVE-2023-26819. (bsc#1241502)
    • Fix the incorrect check in decode_array_index_from_pointer. This fixes CVE-2025-57052. (bsc#1249112)
  • Remove not longer needed patch for NULL to deallocated pointers.
Record
openSUSE-SU-2026:20340-1
Updated
2026-11-02
OSVSUSE-SU-2025:03520-1 No score

Security update for cJSON

This update for cJSON fixes the following issues:

  • CVE-2023-26819: Allocate memory for the temporary buffer when paring numbers (bsc#1241502)
  • CVE-2025-57052: Fix the incorrect check in decode_array_index_from_pointer (bsc#1249112)
Record
SUSE-SU-2025:03520-1
Updated
2026-11-02
OSVUSN-7973-1 No score

cjson vulnerabilities

It was discovered that cJSON incorrectly handled parsing large numbers. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-26819)

It was discovered that cJSON may perform out-of-bounds read when processing specially crafted JSON files using parse_object. An attacker could possibly use this issue to expose sensitive information or crash the program. (CVE-2023-53154)

It was discovered that cJSON incorrectly validated array indices in JSON pointers, which could result in an out-of-bounds memory access. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2025-57052)

Record
USN-7973-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ceph
Azure Linux:3
 through 18.2.2-13 None known
libglvnd
Azure Linux:3
 before 1.7.0-3
1.7.0-3
cjson
Debian:12
 before 1.7.15-1+deb12u3, plus listed versions
1.7.15-11.7.15-1+deb12u11.7.15-1+deb12u2
1.7.15-1+deb12u3
cjson
Debian:13
 before 1.7.18-3.1
1.7.18-3.1
cjson
Debian:14
 before 1.7.18-3.1
1.7.18-3.1
cjson
Debian:11
From an advisory covering 2 CVEs
 before 1.7.14-1+deb11u2, plus listed versions
1.7.14-11.7.14-1+deb11u1
1.7.14-1+deb11u2
cjson
openEuler:22.03-LTS-SP4
 before 1.7.15-6.oe2203sp4
1.7.15-6.oe2203sp4
cjson
openEuler:24.03-LTS-SP2
 before 1.7.15-10.oe2403sp2
1.7.15-10.oe2403sp2
cjson
openEuler:22.03-LTS-SP3
 before 1.7.15-6.oe2203sp3
1.7.15-6.oe2203sp3
cjson
openEuler:24.03-LTS
 before 1.7.15-10.oe2403
1.7.15-10.oe2403
Show 11 moreShow less
Affected packages
PackageAffectedFixed
cjson
openEuler:24.03-LTS-SP1
 before 1.7.15-10.oe2403sp1
1.7.15-10.oe2403sp1
cJSON
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 2 CVEs
 before 1.7.19-150700.3.3.1
1.7.19-150700.3.3.1
cjson
Ubuntu:Pro:20.04:LTS
 before 1.7.10-1.1ubuntu0.1~esm1, plus listed versions
1.7.10-1.1
1.7.10-1.1ubuntu0.1~esm1
cjson
Ubuntu:22.04:LTS
 before 1.7.15-1ubuntu0.1, plus listed versions
1.7.14-11.7.15-1
1.7.15-1ubuntu0.1
cjson
Ubuntu:Pro:24.04:LTS
 before 1.7.17-1ubuntu0.1~esm3, plus listed versions
1.7.16-11.7.16-21.7.17-11.7.17-1ubuntu0.1~esm2
1.7.17-1ubuntu0.1~esm3
cjson
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 1.7.10-1.1ubuntu0.1~esm1, plus listed versions
1.7.10-1.1
1.7.10-1.1ubuntu0.1~esm1
cjson
Ubuntu:22.04:LTS
From an advisory covering 3 CVEs
 before 1.7.15-1ubuntu0.1, plus listed versions
1.7.14-11.7.15-1
1.7.15-1ubuntu0.1
cjson
Ubuntu:Pro:24.04:LTS
From an advisory covering 3 CVEs
 before 1.7.17-1ubuntu0.1~esm3, plus listed versions
1.7.16-11.7.16-21.7.17-11.7.17-1ubuntu0.1~esm2
1.7.17-1ubuntu0.1~esm3
cjson
Ubuntu:25.10
From an advisory covering 3 CVEs
 before 1.7.18-3.1ubuntu0.1, plus listed versions
1.7.18-31.7.18-3.1
1.7.18-3.1ubuntu0.1
cJSON
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.7.19-1.1
1.7.19-1.1
cJSON
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.7.19-160000.1.1
1.7.19-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-26819 is a low vulnerability (CVSS 2.9) in Cjson Project Cjson, published April 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in libglvnd 1.7.0-3.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open