{"id":"CVE-2016-4425","aliases":["DEBIAN-CVE-2016-4425","DLA-471-1","DSA-3577-1","EUVD-2016-5424","GHSA-rf62-m3fm-w623","MGASA-2016-0198","UBUNTU-CVE-2016-4425"],"status":"published","title":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep...","description":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01894,"percentile":0.79751,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-674"],"published":"2016-05-13T00:00:00Z","modified":"2026-10-20T10:47:27Z","fixes":[{"ecosystem":"Debian:12","package":"jansson","fixed_in":["2.7-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jansson","fixed_in":["2.7-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jansson","fixed_in":["2.7-5"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"jansson","fixed_in":["2.3.1-2+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"jansson","fixed_in":["2.7-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"jansson","fixed_in":["2.4-4.1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"jansson","fixed_in":["2.5-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"jansson","fixed_in":["2.7-3ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-5"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2+deb7u1"}]}],"versions":["2.3.1-2"]},{"source":"osv","ecosystem":"Debian:8","package":"jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-1+deb8u1"}]}],"versions":["2.7-1"]},{"source":"osv","ecosystem":"Mageia:5","package":"jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5-2ubuntu0.1"}]}],"versions":["2.4-1","2.5-1","2.5-1ubuntu1","2.5-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jansson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-3ubuntu0.1"}]}],"versions":["2.7-1ubuntu1","2.7-3"]}],"products":[{"vendor":"jansson_project","product":"jansson"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/05/03/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/01/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/02/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/akheron/jansson/issues/282","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"https://github.com/akheron/jansson/pull/284","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://github.com/akheron/jansson/pull/284/commits/64ce0ad3731ebd77e02897b07920eadd0e2cc318","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3577","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4425"},{"url":"https://github.com/advisories/GHSA-rf62-m3fm-w623"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4425","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0198.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18326","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3577","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4425","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4425","description":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.","status":"published","published":"2016-05-17T14:00:00Z","modified":"2025-12-04T17:09:13.364Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:33:35.488991Z"}],"euvd":[{"id":"EUVD-2016-5424","description":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.","status":"published","published":"2016-05-17T14:00:00Z","modified":"2025-12-04T17:09:13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:09.83206Z"}],"ghsa":[{"id":"GHSA-rf62-m3fm-w623","title":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep...","description":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.","status":"published","published":"2022-05-17T03:54:54Z","modified":"2025-12-04T18:30:28Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-674"],"updated_at":"2026-11-02T15:05:03.172685Z"}],"nvd":[{"id":"CVE-2016-4425","description":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.","status":"published","published":"2016-05-17T14:08:12.657Z","modified":"2026-06-17T00:47:31.83Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-674"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"CVE-2016-4425","description":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.","status":"published","published":"2016-05-17T14:08:12.657Z","modified":"2026-10-20T10:47:27.970349942Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4425","description":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.","status":"published","published":"2016-05-17T14:08:12.657Z","modified":"2026-09-22T07:01:02.890194943Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4425","description":"Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.","status":"published","published":"2016-05-17T14:08:00Z","modified":"2026-04-22T10:43:52.187197Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-471-1","title":"jansson - security update","status":"published","published":"2016-05-13T00:00:00Z","modified":"2026-03-09T02:09:54.860306Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3577-1","title":"jansson - security update","status":"published","published":"2016-05-14T00:00:00Z","modified":"2026-03-09T01:21:56.051592Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0198","title":"Updated jansson packages fix CVE-2016-4425","description":"Updated jansson packages fix security vulnerability:\n\nGustavo Grieco discovered that jansson did not limit the recursion depth when\nparsing JSON arrays and objects. This could allow remote attackers to cause a\ndenial of service (crash) via stack exhaustion, using crafted JSON data\n(CVE-2016-4425).\n","status":"published","published":"2016-05-21T22:11:24Z","modified":"2026-04-16T06:24:58.593381708Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}