{"id":"CVE-2025-57052","aliases":["ALPINE-CVE-2025-57052","BELL-CVE-2025-57052","DEBIAN-CVE-2025-57052","DLA-4304-1","DSA-6001-1","EUVD-2025-26527","GHSA-98j5-4649-rfv2","OESA-2025-2374","OESA-2025-2375","OESA-2025-2376","OESA-2025-2377","OESA-2025-2491","RHSA-2025:17606","RHSA-2025:17613","RHSA-2025:17614","SUSE-SU-2025:03520-1","UBUNTU-CVE-2025-57052","USN-7973-1","openSUSE-SU-2025:15583-1","openSUSE-SU-2026:20340-1"],"status":"published","title":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer...","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0077,"percentile":0.56054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125","CWE-129"],"published":"2025-09-03T00:00:00Z","modified":"2026-10-28T02:30:43Z","exploits":[{"source":"pocgithub","id":"DhruvP2205/cjson-rust-port","title":"DhruvP2205/cjson-rust-port","date":"2026-08-02","url":"https://github.com/DhruvP2205/cjson-rust-port"}],"fixes":[{"ecosystem":"Alpine:v3.19","package":"cjson","fixed_in":["1.7.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cjson","fixed_in":["1.7.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cjson","fixed_in":["1.7.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cjson","fixed_in":["1.7.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cjson","fixed_in":["1.7.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cjson","fixed_in":["1.7.19-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cjson","fixed_in":["1.7.15-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cjson","fixed_in":["1.7.18-3.1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cjson","fixed_in":["1.7.19-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"cjson","fixed_in":["1.7.14-1+deb11u3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"cjson","fixed_in":["1.7.15-7.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"cjson","fixed_in":["1.7.15-7.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"cjson","fixed_in":["1.7.15-11.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"cjson","fixed_in":["1.7.15-11.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"cjson","fixed_in":["1.7.15-11.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cjson","fixed_in":["1.7.10-1.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cjson","fixed_in":["1.7.15-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cjson","fixed_in":["1.7.17-1ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"cjson","fixed_in":["1.7.18-3.1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.7.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.7.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.7.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.7.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.7.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.7.19-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-1+deb12u4"}]}],"versions":["1.7.15-1","1.7.15-1+deb12u1","1.7.15-1+deb12u2","1.7.15-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.18-3.1+deb13u1"}]}],"versions":["1.7.18-3.1"]},{"source":"osv","ecosystem":"Debian:14","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.19-1"}]}],"versions":["1.7.18-3.1","1.7.18-4"]},{"source":"osv","ecosystem":"Debian:11","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1+deb11u3"}]}],"versions":["1.7.14-1","1.7.14-1+deb11u1","1.7.14-1+deb11u2"]},{"source":"osv","ecosystem":"Debian:12","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-1+deb12u4"}]}],"versions":["1.7.15-1","1.7.15-1+deb12u1","1.7.15-1+deb12u2","1.7.15-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.18-3.1+deb13u1"}]}],"versions":["1.7.18-3.1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-7.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-7.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-11.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-11.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-11.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.8.1-3.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el9sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el9pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.34.0-4.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.34.0-4.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"cjson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"cjson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.18-2.el8sat"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.24-0.1.el8pc"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"cJSON","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.19-150700.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.10-1.1ubuntu0.1~esm1"}]}],"versions":["1.7.10-1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-1ubuntu0.1"}]}],"versions":["1.7.14-1","1.7.15-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-1ubuntu0.1~esm3"}]}],"versions":["1.7.16-1","1.7.16-2","1.7.17-1","1.7.17-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.18-3.1ubuntu0.1"}]}],"versions":["1.7.18-3","1.7.18-3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.10-1.1ubuntu0.1~esm1"}]}],"versions":["1.7.10-1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15-1ubuntu0.1"}]}],"versions":["1.7.14-1","1.7.15-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-1ubuntu0.1~esm3"}]}],"versions":["1.7.16-1","1.7.16-2","1.7.17-1","1.7.17-1ubuntu0.1~esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.18-3.1ubuntu0.1"}]}],"versions":["1.7.18-3","1.7.18-3.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cJSON","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.19-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cJSON","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.19-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"davegamble","product":"cjson"}],"references":[{"url":"https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability","tags":["Exploit","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00019.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57052","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-98j5-4649-rfv2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-57052","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-57052","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57052.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-57052","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2374","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2375","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2376","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2377","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2491","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17606","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.17/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2398216","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-38394","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38396","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38397","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38398","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38496","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38730","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17606.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10990","tags":["advisory"]},{"url":"https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f","tags":["article"]},{"url":"https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m","tags":["article"]},{"url":"https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-57052","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-57052","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-57833","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-57833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57833","tags":["advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["article"]},{"url":"https://groups.google.com/g/django-announce","tags":["article"]},{"url":"https://www.djangoproject.com/weblog/2025/sep/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17613","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-38406","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38408","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38410","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-38411","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17613.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17614","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17614.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-49761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2322153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49761","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503520-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241502","tags":["report"]},{"url":"https://bugzilla.suse.com/1249112","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57052","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-57052","tags":["report"]},{"url":"https://github.com/DaveGamble/cJSON/pull/957","tags":["report"]},{"url":"https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa4139126967f6d289b675b4b36fef","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7973-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-26819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-53154","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-57052","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","status":"published","published":"2025-09-03T00:00:00Z","modified":"2025-11-03T18:13:42.953Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-129","CWE-125"],"updated_at":"2026-11-02T14:32:35.099955Z"}],"euvd":[{"id":"EUVD-2025-26527","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","status":"published","published":"2025-09-03T00:00:00Z","modified":"2025-11-03T18:13:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:34.635725Z"}],"ghsa":[{"id":"GHSA-98j5-4649-rfv2","title":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer...","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","status":"published","published":"2025-09-03T15:30:34Z","modified":"2025-11-03T21:34:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:04:24.41654Z"}],"nvd":[{"id":"CVE-2025-57052","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","status":"published","published":"2025-09-03T15:15:38.25Z","modified":"2026-11-07T18:10:00.2Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-125","CWE-129"],"updated_at":"2026-11-07T20:06:28.095135Z"}],"osv":[{"id":"ALPINE-CVE-2025-57052","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","status":"published","published":"2025-09-03T15:15:38.25Z","modified":"2026-08-27T22:18:02.993056822Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-57052","title":"CVE-2025-57052 does not affect BellSoft software","status":"withdrawn","published":"2025-09-05T06:02:43.638004Z","modified":"2026-01-26T09:47:13.144338Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-57052","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","status":"published","published":"2025-09-03T00:00:00Z","modified":"2026-11-09T02:30:45.036532683Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"DEBIAN-CVE-2025-57052","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","status":"published","published":"2025-09-03T15:15:38.25Z","modified":"2026-11-08T09:47:36.083780783Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-08T10:03:28.621517Z"},{"id":"OESA-2025-2374","title":"cjson security update","description":"cJSON aims to be the dumbest possible parser that you can get your job done with. It\u0026amp;apos;s a single file of C, and a single header file.   %package devel Summary:        Development files for cJSON Requires:        = -    %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON.    %prep %autosetup -n cJSON- -p1\r\n\r\nSecurity Fix(es):\n\ncJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.(CVE-2025-57052)","status":"published","published":"2025-10-11T11:09:27Z","modified":"2026-08-18T01:19:12.112203806Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2375","title":"cjson security update","description":"cJSON aims to be the dumbest possible parser that you can get your job done with. It\u0026amp;apos;s a single file of C, and a single header file.   %package devel Summary:        Development files for cJSON Requires:        = -    %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON.    %prep %autosetup -n cJSON- -p1\r\n\r\nSecurity Fix(es):\n\ncJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.(CVE-2025-57052)","status":"published","published":"2025-10-11T11:09:27Z","modified":"2026-08-18T01:19:12.726921713Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2376","title":"cjson security update","description":"cJSON aims to be the dumbest possible parser that you can get your job done with. It\u0026amp;apos;s a single file of C, and a single header file.   %package devel Summary:        Development files for cJSON Requires:        = -    %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON.    %prep %autosetup -n cJSON- -p1\r\n\r\nSecurity Fix(es):\n\ncJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.(CVE-2025-57052)","status":"published","published":"2025-10-11T11:09:27Z","modified":"2026-08-18T01:19:12.560888329Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2377","title":"cjson security update","description":"cJSON aims to be the dumbest possible parser that you can get your job done with. It\u0026amp;apos;s a single file of C, and a single header file.   %package devel Summary:        Development files for cJSON Requires:        = -    %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON.    %prep %autosetup -n cJSON- -p1\r\n\r\nSecurity Fix(es):\n\ncJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.(CVE-2025-57052)","status":"published","published":"2025-10-11T11:09:27Z","modified":"2026-08-18T01:19:12.238960033Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2491","title":"cjson security update","description":"cJSON aims to be the dumbest possible parser that you can get your job done with. It\u0026amp;apos;s a single file of C, and a single header file.   %package devel Summary:        Development files for cJSON Requires:        = -    %description devel The cjson-devel package contains libraries and header files for developing applications that use cJSON.    %prep %autosetup -n cJSON- -p1\r\n\r\nSecurity Fix(es):\n\ncJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.(CVE-2025-57052)","status":"published","published":"2025-10-17T11:09:35Z","modified":"2026-08-18T01:19:15.162404844Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2025:17606","title":"Red Hat Security Advisory: Satellite 6.17.5 Async Update","status":"published","published":"2025-10-09T10:20:50Z","modified":"2026-06-29T11:14:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17613","title":"Red Hat Security Advisory: Satellite 6.16.5.4 Async Update","status":"published","published":"2025-10-09T10:20:51Z","modified":"2026-06-29T11:14:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17614","title":"Red Hat Security Advisory: Satellite 6.15.5.5 Async Update","status":"published","published":"2025-10-09T10:20:52Z","modified":"2026-06-30T10:19:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"UBUNTU-CVE-2025-57052","description":"cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.","status":"published","published":"2025-09-03T15:15:00Z","modified":"2026-04-22T16:07:05.9419Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"DLA-4304-1","title":"cjson - security update","status":"published","published":"2025-09-18T00:00:00Z","modified":"2026-03-09T02:11:37.735551Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6001-1","title":"cjson - security update","status":"published","published":"2025-09-14T00:00:00Z","modified":"2026-03-09T02:09:21.057104Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2025:15583-1","title":"cJSON-devel-1.7.19-1.1 on GA media","description":"These are all security issues fixed in the cJSON-devel-1.7.19-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-29T00:00:00Z","modified":"2026-03-23T04:53:58.240612Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20340-1","title":"Security update for cJSON","description":"This update for cJSON fixes the following issues:\n\n- Update to version 1.7.19\n  * Check for NULL in cJSON_DetachItemViaPointer.\n  * Check overlap before calling strcpy in cJSON_SetValuestring.\n  * Fix Max recursion depth for cJSON_Duplicate to prevent stack\n    exhaustion.\n  * Allocate memory for the temporary buffer when paring numbers.\n    This fixes CVE-2023-26819. (bsc#1241502)\n  * Fix the incorrect check in decode_array_index_from_pointer.\n    This fixes CVE-2025-57052. (bsc#1249112)\n- Remove not longer needed patch for NULL to deallocated pointers.\n\n","status":"published","published":"2026-03-11T08:21:26Z","modified":"2026-03-23T04:54:51.385572Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:03520-1","title":"Security update for cJSON","description":"This update for cJSON fixes the following issues:\n\n- CVE-2023-26819: Allocate memory for the temporary buffer when paring numbers (bsc#1241502)\n- CVE-2025-57052: Fix the incorrect check in decode_array_index_from_pointer (bsc#1249112)\n","status":"published","published":"2025-10-10T07:22:44Z","modified":"2026-02-04T04:07:23.805289Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"USN-7973-1","title":"cjson vulnerabilities","description":"It was discovered that cJSON incorrectly handled parsing large numbers. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2023-26819)\n\nIt was discovered that cJSON may perform out-of-bounds read when processing\nspecially crafted JSON files using parse_object. An attacker could possibly\nuse this issue to expose sensitive information or crash the program.\n(CVE-2023-53154)\n\nIt was discovered that cJSON incorrectly validated array indices in JSON\npointers, which could result in an out-of-bounds memory access. An attacker\ncould possibly use this issue to cause a denial of service, or execute\narbitrary code. (CVE-2025-57052)","status":"published","published":"2026-01-23T04:53:55Z","modified":"2026-04-27T18:34:23.159999Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}