{"id":"CVE-2023-50472","aliases":["ALPINE-CVE-2023-50472","AZL-32207","AZL-67467","BELL-CVE-2023-50472","DEBIAN-CVE-2023-50472","EUVD-2023-55257","GHSA-278h-99f9-m238","MGASA-2024-0156","OESA-2024-2302","OESA-2024-2303","RHSA-2025:9838","UBUNTU-CVE-2023-50472","USN-6784-1","openSUSE-SU-2024:0139-1","openSUSE-SU-2024:13537-1"],"status":"published","title":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function...","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00969,"percentile":0.62156,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2023-12-14T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"apparmor","fixed_in":["3.0.4-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"apparmor","fixed_in":["3.1.7-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"cjson","fixed_in":["1.7.17-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cjson","fixed_in":["1.7.15-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cjson","fixed_in":["1.7.17-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cjson","fixed_in":["1.7.17-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cjson","fixed_in":["1.7.15-1ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"apparmor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"apparmor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.15-r2"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.15-r2"},{"fixed":"1.7.17-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-1+deb12u1"}]}],"versions":["1.7.15-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-2.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-5.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-5.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.14-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-1ubuntu0.1~esm2"}]}],"versions":["1.7.14-1","1.7.15-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-1ubuntu0.1~esm2"}]}],"versions":["1.7.14-1","1.7.15-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-1ubuntu0.1~esm2"}]}],"versions":["1.7.16-1","1.7.16-2","1.7.17-1"],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"cJSON","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.18-bp155.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cJSON","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.18-bp155.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cJSON","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-1.1"}]}],"bundled":2}],"products":[{"vendor":"davegamble","product":"cjson"}],"references":[{"url":"https://github.com/DaveGamble/cJSON/issues/803","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50472","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-278h-99f9-m238"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-50472","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-50472","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-1","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50472.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-50472","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0156.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33133","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50471","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2303","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9838","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2277268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2364966","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9838.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-50471","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-50471","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-50472","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-50472","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4340","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2m57-hf25-phgg","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-31755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31755","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31755","tags":["advisory"]},{"url":"https://github.com/DaveGamble/cJSON/issues/839","tags":["article"]},{"url":"https://github.com/advisories/GHSA-5g69-hr8r-x577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-46727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46727","tags":["advisory"]},{"url":"https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712","tags":["article"]},{"url":"https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3","tags":["article"]},{"url":"https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74","tags":["article"]},{"url":"https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2023-50472","tags":["report"]},{"url":"https://github.com/DaveGamble/cJSON/commit/60ff122ef5862d04b39b150541459e7f5e35add8","tags":["report"]},{"url":"https://github.com/DaveGamble/cJSON/commit/f66cbab4bfb3926ffd4c5e13f9fb6d506ee0241d","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6784-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-50471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-31755","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/36QNMKFWNRJX3XHLNGZ3DNLMLIHSRF4U/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218098","tags":["report"]},{"url":"https://bugzilla.suse.com/1218099","tags":["report"]},{"url":"https://bugzilla.suse.com/1223420","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31755","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-50472","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2024-08-28T14:15:13.394Z","updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-55257","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2024-08-28T14:15:13Z","updated_at":"2026-11-03T00:56:09.376102Z"}],"ghsa":[{"id":"GHSA-278h-99f9-m238","title":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function...","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T21:31:16Z","modified":"2023-12-28T05:05:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:55:16.928981Z"}],"nvd":[{"id":"CVE-2023-50472","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T20:15:53.18Z","modified":"2026-06-17T06:39:43.15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:08:54.696438Z"}],"osv":[{"id":"ALPINE-CVE-2023-50472","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T20:15:53.18Z","modified":"2026-10-26T17:17:58.658987919Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-32207","title":"CVE-2023-50472 affecting package apparmor for versions less than 3.0.4-3","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T20:15:53Z","modified":"2026-04-21T04:26:43.456445Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-67467","title":"CVE-2023-50472 affecting package apparmor for versions less than 3.1.7-1","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T20:15:53Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:23.994498Z"},{"id":"BELL-CVE-2023-50472","status":"published","published":"2023-12-14T20:15:00Z","modified":"2026-01-26T09:36:47.163722Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:18.192656Z"},{"id":"DEBIAN-CVE-2023-50472","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T20:15:53.18Z","modified":"2026-10-26T18:02:58.599170935Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"OESA-2024-2302","title":"cjson security update","description":"cJSON aims to be the dumbest possible parser that you can get your job done with. It\u0026apos;s a single file of C, and a single header file.   %package devel Summary:        Development files for cJSON Requires:        = - Requires:       pkgconfig    %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON.    %prep %autosetup -n cJSON-\r\n\r\nSecurity Fix(es):\r\n\r\ncJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.(CVE-2023-50471)\r\n\r\ncJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.(CVE-2023-50472)","status":"published","published":"2024-10-25T11:07:46Z","modified":"2026-08-18T01:17:36.029869897Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2303","title":"cjson security update","description":"cJSON aims to be the dumbest possible parser that you can get your job done with. It\u0026apos;s a single file of C, and a single header file.   %package devel Summary:        Development files for cJSON Requires:        = - Requires:       pkgconfig    %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON.    %prep %autosetup -n cJSON-\r\n\r\nSecurity Fix(es):\r\n\r\ncJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.(CVE-2023-50471)\r\n\r\ncJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.(CVE-2023-50472)","status":"published","published":"2024-10-25T11:07:46Z","modified":"2026-08-18T01:17:35.832674218Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2025:9838","title":"Red Hat Security Advisory: Satellite 6.15.5.3 Async Update","status":"published","published":"2025-06-27T10:05:49Z","modified":"2026-10-17T10:08:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"UBUNTU-CVE-2023-50472","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T20:15:00Z","modified":"2026-04-22T14:14:49.797288Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CVE-2023-50472","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2026-10-28T02:30:51.707883421Z","updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"MGASA-2024-0156","title":"Updated cjson packages fix security vulnerabilities","description":"cJSON v1.7.16 was discovered to contain a segmentation violation via the\nfunction cJSON_InsertItemInArray at cJSON.c. (CVE-2023-50471)\ncJSON v1.7.16 was discovered to contain a segmentation violation via the\nfunction cJSON_SetValuestring at cJSON.c. (CVE-2023-50472)\n","status":"published","published":"2024-04-30T22:25:14Z","modified":"2026-04-16T04:43:44.517161553Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0139-1","title":"Security update for cJSON","description":"This update for cJSON fixes the following issues:\n\n- Update to 1.7.18:\n  * CVE-2024-31755: NULL pointer dereference via cJSON_SetValuestring() (boo#1223420)\n  * Remove non-functional list handling of compiler flags\n  * Fix heap buffer overflow\n  * remove misused optimization flag -01\n  * Set free'd pointers to NULL whenever they are not reassigned\n    immediately after\n\n- Update to version 1.7.17 (boo#1218098, CVE-2023-50472,\n    boo#1218099, CVE-2023-50471):\n  * Fix null reference in cJSON_SetValuestring (CVE-2023-50472).\n  * Fix null reference in cJSON_InsertItemInArray (CVE-2023-50471).\n\n- Update to 1.7.16:\n  * Add an option for ENABLE_CJSON_VERSION_SO in CMakeLists.txt\n  * Add cmake_policy to CMakeLists.txt\n  * Add cJSON_SetBoolValue\n  * Add meson documentation\n  * Fix memory leak in merge_patch\n  * Fix conflicting target names 'uninstall'\n  * Bump cmake version to 3.0 and use new version syntax\n  * Print int without decimal places\n  * Fix 'cjson_utils-static' target not exist\n  * Add allocate check for replace_item_in_object\n  * Fix a null pointer crash in cJSON_ReplaceItemViaPointer\n","status":"published","published":"2024-05-25T08:47:48Z","modified":"2026-02-04T03:51:15.787085Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13537-1","title":"cJSON-devel-1.7.17-1.1 on GA media","description":"These are all security issues fixed in the cJSON-devel-1.7.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:02:36.665116Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"USN-6784-1","title":"cjson vulnerabilities","description":"It was discovered that cJSON incorrectly handled certain input. An\nattacker could possibly use this issue to cause cJSON to crash, resulting\nin a denial of service. This issue only affected Ubuntu 22.04 LTS and\nUbuntu 23.10. (CVE-2023-50471, CVE-2023-50472)\n\nLuo Jin discovered that cJSON incorrectly handled certain input. An\nattacker could possibly use this issue to cause cJSON to crash, resulting\nin a denial of service. (CVE-2024-31755)\n","status":"published","published":"2024-05-23T13:00:48Z","modified":"2026-04-27T17:13:52.581685Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}