Every CVE Search/ Get API key

CVE-2023-50471

cJSON v1.7.16 was discovered to contain a segmentation violation via the function...

7.5 HighFix available

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.52%Up 1.5 points since Dec 15, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
CVE-2023-50471
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
CVE-2023-50471
Updated
2026-11-02
EUVDEUVD-2023-55256 No score

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
EUVD-2023-55256
Updated
2026-11-02
GitHub AdvisoriesGHSA-xgc4-4vwx-6v94 7.5

cJSON v1.7.16 was discovered to contain a segmentation violation via the function...

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
GHSA-xgc4-4vwx-6v94
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2023-50471 7.5

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
ALPINE-CVE-2023-50471
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-32206 7.5

CVE-2023-50471 affecting package apparmor for versions less than 3.0.4-3

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
AZL-32206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVAZL-67464 7.5

CVE-2023-50471 affecting package apparmor for versions less than 3.1.7-1

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
AZL-67464
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVBELL-CVE-2023-50471 7.5
Record
BELL-CVE-2023-50471
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-50471 7.5

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
DEBIAN-CVE-2023-50471
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-2302 7.5

cjson security update

cJSON aims to be the dumbest possible parser that you can get your job done with. It's a single file of C, and a single header file. %package devel Summary: Development files for cJSON Requires: = - Requires: pkgconfig %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON. %prep %autosetup -n cJSON-

Security Fix(es):

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.(CVE-2023-50471)

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.(CVE-2023-50472)

Record
OESA-2024-2302
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-2303 7.5

cjson security update

cJSON aims to be the dumbest possible parser that you can get your job done with. It's a single file of C, and a single header file. %package devel Summary: Development files for cJSON Requires: = - Requires: pkgconfig %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON. %prep %autosetup -n cJSON-

Security Fix(es):

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.(CVE-2023-50471)

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.(CVE-2023-50472)

Record
OESA-2024-2303
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:9838 7.5

Red Hat Security Advisory: Satellite 6.15.5.3 Async Update

Record
RHSA-2025:9838
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-50471 7.5

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
UBUNTU-CVE-2023-50471
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV No score

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

Record
CVE-2023-50471
Updated
2026-11-02
OSVMGASA-2024-0156 No score

Updated cjson packages fix security vulnerabilities

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. (CVE-2023-50471) cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. (CVE-2023-50472)

Record
MGASA-2024-0156
Updated
2026-11-02
OSVopenSUSE-SU-2024:0139-1 No score

Security update for cJSON

This update for cJSON fixes the following issues:

  • Update to 1.7.18:

    • CVE-2024-31755: NULL pointer dereference via cJSON_SetValuestring() (boo#1223420)
    • Remove non-functional list handling of compiler flags
    • Fix heap buffer overflow
    • remove misused optimization flag -01
    • Set free'd pointers to NULL whenever they are not reassigned immediately after

  • Update to version 1.7.17 (boo#1218098, CVE-2023-50472, boo#1218099, CVE-2023-50471):

    • Fix null reference in cJSON_SetValuestring (CVE-2023-50472).
    • Fix null reference in cJSON_InsertItemInArray (CVE-2023-50471).

  • Update to 1.7.16:

    • Add an option for ENABLE_CJSON_VERSION_SO in CMakeLists.txt
    • Add cmake_policy to CMakeLists.txt
    • Add cJSON_SetBoolValue
    • Add meson documentation
    • Fix memory leak in merge_patch
    • Fix conflicting target names 'uninstall'
    • Bump cmake version to 3.0 and use new version syntax
    • Print int without decimal places
    • Fix 'cjson_utils-static' target not exist
    • Add allocate check for replace_item_in_object
    • Fix a null pointer crash in cJSON_ReplaceItemViaPointer
Record
openSUSE-SU-2024:0139-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13537-1 No score

cJSON-devel-1.7.17-1.1 on GA media

These are all security issues fixed in the cJSON-devel-1.7.17-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13537-1
Updated
2026-11-02
OSVUSN-6784-1 No score

cjson vulnerabilities

It was discovered that cJSON incorrectly handled certain input. An attacker could possibly use this issue to cause cJSON to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-50471, CVE-2023-50472)

Luo Jin discovered that cJSON incorrectly handled certain input. An attacker could possibly use this issue to cause cJSON to crash, resulting in a denial of service. (CVE-2024-31755)

Record
USN-6784-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cjson
Alpine:v3.15
 before 1.7.17-r0
1.7.17-r0
cjson
Alpine:v3.16
 before 1.7.17-r0
1.7.17-r0
cjson
Alpine:v3.17
 before 1.7.17-r0
1.7.17-r0
cjson
Alpine:v3.18
 before 1.7.17-r0
1.7.17-r0
cjson
Alpine:v3.19
 before 1.7.17-r0
1.7.17-r0
cjson
Alpine:v3.20
 before 1.7.17-r0
1.7.17-r0
cjson
Alpine:v3.21
 before 1.7.17-r0
1.7.17-r0
cjson
Alpine:v3.22
 before 1.7.17-r0
1.7.17-r0
cjson
Alpine:v3.23
 before 1.7.17-r0
1.7.17-r0
cjson
Alpine:v3.24
 before 1.7.17-r0
1.7.17-r0
Show 29 moreShow less
Affected packages
PackageAffectedFixed
apparmor
Azure Linux:2
 before 3.0.4-3
3.0.4-3
apparmor
Azure Linux:3
 before 3.1.7-1
3.1.7-1
cjson
Alpaquita:23
 1.7.15-r2 up to 1.7.17-r0
1.7.17-r0
cjson
Alpaquita:stream
 1.7.15-r2 up to 1.7.17-r0
1.7.17-r0
cjson
Debian:12
 before 1.7.15-1+deb12u1, plus listed versions
1.7.15-1
1.7.15-1+deb12u1
cjson
Debian:13
 before 1.7.17-1
1.7.17-1
cjson
Debian:14
 before 1.7.17-1
1.7.17-1
cjson
Debian:10
 before 1.7.10-1.1+deb10u2, plus listed versions
1.7.10-1.11.7.10-1.1+deb10u1
1.7.10-1.1+deb10u2
cjson
Mageia:9
From an advisory covering 2 CVEs
 before 1.7.15-2.1.mga9
1.7.15-2.1.mga9
cjson
openEuler:22.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.7.15-5.oe2203sp3
1.7.15-5.oe2203sp3
cjson
openEuler:22.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.7.15-5.oe2203sp1
1.7.15-5.oe2203sp1
cjson
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 5 CVEs
 before 0:1.7.18-1.el8sat
0:1.7.18-1.el8sat
cjson-debuginfo
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 5 CVEs
 before 0:1.7.18-1.el8sat
0:1.7.18-1.el8sat
cjson-debugsource
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 5 CVEs
 before 0:1.7.18-1.el8sat
0:1.7.18-1.el8sat
cjson
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:1.7.18-1.el8sat
0:1.7.18-1.el8sat
cjson-debuginfo
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:1.7.18-1.el8sat
0:1.7.18-1.el8sat
cjson-debugsource
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:1.7.18-1.el8sat
0:1.7.18-1.el8sat
python-sqlparse
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 5 CVEs
 before 0:0.5.0-1.el8pc
0:0.5.0-1.el8pc
python3.11-sqlparse
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 5 CVEs
 before 0:0.5.0-1.el8pc
0:0.5.0-1.el8pc
python-sqlparse
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:0.5.0-1.el8pc
0:0.5.0-1.el8pc
python3.11-sqlparse
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:0.5.0-1.el8pc
0:0.5.0-1.el8pc
rubygem-rack
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 5 CVEs
 before 0:2.2.14-1.el8sat
0:2.2.14-1.el8sat
rubygem-rack
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:2.2.14-1.el8sat
0:2.2.14-1.el8sat
cjson
Ubuntu:Pro:22.04:LTS
 before 1.7.15-1ubuntu0.1~esm2, plus listed versions
1.7.14-11.7.15-1
1.7.15-1ubuntu0.1~esm2
cjson
Ubuntu:Pro:22.04:LTS
From an advisory covering 3 CVEs
 before 1.7.15-1ubuntu0.1~esm2, plus listed versions
1.7.14-11.7.15-1
1.7.15-1ubuntu0.1~esm2
cjson
Ubuntu:Pro:24.04:LTS
From an advisory covering 3 CVEs
 before 1.7.17-1ubuntu0.1~esm2, plus listed versions
1.7.16-11.7.16-21.7.17-1
1.7.17-1ubuntu0.1~esm2
cJSON
SUSE:Package Hub 15 SP5
From an advisory covering 3 CVEs
 before 1.7.18-bp155.3.3.1
1.7.18-bp155.3.3.1
cJSON
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
 before 1.7.18-bp155.3.3.1
1.7.18-bp155.3.3.1
cJSON
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.7.17-1.1
1.7.17-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-50471 is a high vulnerability (CVSS 7.5) in Davegamble Cjson, published December 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in cjson 1.7.17-r0.

References

Show 56 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open