{"id":"CVE-2021-32292","aliases":["AZL-28060","BIT-json-c-2021-32292","DEBIAN-CVE-2021-32292","DSA-5486-1","EUVD-2021-19147","GHSA-gf2h-qrq9-jg6v","OESA-2023-1571","OESA-2023-1572","OESA-2023-1573","UBUNTU-CVE-2021-32292","USN-6310-1"],"status":"published","title":"An issue was discovered in json-c through 0.15-20200726. A stack-buffer-overflow exists in the...","description":"An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01353,"percentile":0.71806,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-08-22T00:00:00Z","modified":"2026-10-20T10:54:41Z","fixes":[{"ecosystem":"Azure Linux:2","package":"json-c","fixed_in":["0.15-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"json-c","fixed_in":["0.16-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"json-c","fixed_in":["0.16-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"json-c","fixed_in":["0.16-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"json-c","fixed_in":["0.15-2+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"json-c","fixed_in":["0.15-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"json-c","fixed_in":["0.15-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"json-c","fixed_in":["0.15-6.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"json-c","fixed_in":["0.15-3~ubuntu1.22.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15-2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"json-c","ranges":[{"type":"SEMVER","events":[{"introduced":"0.15-20200726.0"},{"last_affected":"0.15-20200726.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15-2+deb11u1"}]}],"versions":["0.15-2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15-6.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15-3~ubuntu1.22.04.2"}]}],"versions":["0.15-2build2","0.15-2build3","0.15-2build4","0.15-3~ubuntu1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"json-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15-3~ubuntu1.22.04.2"}]}],"versions":["0.15-2build2","0.15-2build3","0.15-2build4","0.15-3~ubuntu1.22.04.1"]}],"products":[{"vendor":"json-c","product":"json-c"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://github.com/json-c/json-c/issues/654","tags":["x_transferred","Exploit","Issue Tracking","web","report"]},{"url":"https://www.debian.org/security/2023/dsa-5486","tags":["vendor-advisory","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230929-0010/","tags":["x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32292","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230929-0010"},{"url":"https://github.com/advisories/GHSA-gf2h-qrq9-jg6v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32292","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1571","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1572","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1573","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-32292","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6310-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32292","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-32292","description":"An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2026-10-14T11:39:36.46Z","updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-19147","description":"An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2026-10-14T11:39:36Z","updated_at":"2026-11-02T17:27:16.356399Z"}],"ghsa":[{"id":"GHSA-gf2h-qrq9-jg6v","title":"An issue was discovered in json-c through 0.15-20200726. A stack-buffer-overflow exists in the...","description":"An issue was discovered in json-c through 0.15-20200726. A stack-buffer-overflow exists in the function parseit located in json_parse.c. It allows an attacker to cause code Execution.","status":"published","published":"2023-08-22T21:30:26Z","modified":"2026-10-14T12:32:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:13:24.812204Z"}],"nvd":[{"id":"CVE-2021-32292","description":"An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.","status":"published","published":"2023-08-22T19:16:20.35Z","modified":"2026-10-14T12:17:11.93Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"AZL-28060","title":"CVE-2021-32292 affecting package json-c for versions less than 0.15-2","description":"An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.","status":"published","published":"2023-08-22T19:16:20Z","modified":"2026-04-21T04:25:48.306179Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"CVE-2021-32292","description":"An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.","status":"published","published":"2023-08-22T19:16:20.35Z","modified":"2026-10-20T10:54:41.437555673Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32292","description":"An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.","status":"published","published":"2023-08-22T19:16:20.35Z","modified":"2026-10-15T09:47:26.697190877Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2023-1571","title":"json-c security update","description":"JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C, output them as JSON formatted strings and parse JSON formatted strings back into the C representation of JSON objects.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in json-c through 0.15-20200726. A stack-buffer-overflow exists in the function parseit located in json_parse.c. It allows an attacker to cause code Execution.(CVE-2021-32292)","status":"published","published":"2023-09-02T11:06:01Z","modified":"2026-08-18T01:17:52.41148166Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1572","title":"json-c security update","description":"JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C, output them as JSON formatted strings and parse JSON formatted strings back into the C representation of JSON objects.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in json-c through 0.15-20200726. A stack-buffer-overflow exists in the function parseit located in json_parse.c. It allows an attacker to cause code Execution.(CVE-2021-32292)","status":"published","published":"2023-09-02T11:06:01Z","modified":"2026-08-18T01:17:52.427439521Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1573","title":"json-c security update","description":"JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C, output them as JSON formatted strings and parse JSON formatted strings back into the C representation of JSON objects.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in json-c through 0.15-20200726. A stack-buffer-overflow exists in the function parseit located in json_parse.c. It allows an attacker to cause code Execution.(CVE-2021-32292)","status":"published","published":"2023-09-02T11:06:01Z","modified":"2026-08-18T01:17:52.490335812Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2021-32292","description":"An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.","status":"published","published":"2023-08-22T19:16:00Z","modified":"2026-04-22T12:53:34.406467Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"BIT-json-c-2021-32292","description":"An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.","status":"published","published":"2024-01-31T15:14:57.095Z","modified":"2024-02-19T10:36:29.17Z","updated_at":"2026-11-02T15:28:31.782692Z"},{"id":"DSA-5486-1","title":"json-c - security update","status":"published","published":"2023-08-30T00:00:00Z","modified":"2026-03-09T02:08:47.962278Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-6310-1","title":"json-c vulnerability","description":"It was discovered that json-c incorrectly handled certain JSON files.\nAn attacker could possibly use this issue to cause a crash or\nexecute arbitrary code.\n","status":"published","published":"2023-08-28T19:18:41Z","modified":"2026-04-22T10:37:59.261531Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}