Crow JSON Parser Uncontrolled Recursion Leading to DoS

Executive Summary

CVE-2026-116011 is a high-severity Denial of Service (DoS) vulnerability in Crow versions before 1.3.4. It occurs in the crow::json::load() function where deeply nested JSON data triggers uncontrolled recursion, exhausting the worker thread stack and crashing the server. Attackers can remotely send maliciously crafted JSON with thousands of nested objects to terminate the process and drop all connections.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in Crow servers when processing deeply nested JSON. Check server logs for stack overflow errors or 400 Bad Request responses from malformed JSON. Use network traffic analysis tools like Wireshark to inspect incoming JSON payloads for excessive nesting levels.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote unauthenticated attackers to crash your Crow server by sending deeply nested JSON. The server will terminate all active connections, causing downtime and loss of service. On Windows, around 4000 nested objects can trigger a stack overflow, while Linux systems may handle it differently but still risk crashes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Crow to version 1.3.4 or later. If upgrading is not possible, reduce the JSON parser's max_depth to 1024 or lower in the json.h file. Implement input validation to reject deeply nested JSON requests. Monitor for and block suspicious JSON payloads with thousands of nested objects.

Useful 0 Not Useful 0