CVE-2026-67216

Analyzed Analyzed - Analysis Complete

cJSON Inefficient Algorithmic Complexity in Object Comparison

Publication date: 2026-07-29

Last updated on: 2026-08-04

Assigner: VulnCheck

Description

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67216

Affected Vendors & Products

Vendor	Product	Version / Range
davegamble	cjson	to 1.7.19 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability is in the cJSON library version 1.7.19 or earlier. The function cJSON_Compare() has an inefficient algorithm that compares JSON objects by recursing into shared subtrees twice without a depth limit. This causes exponential time complexity based on nesting depth, leading to excessive CPU usage.

Detection Guidance

Detecting this vulnerability requires checking if your system uses cJSON versions before 1.7.20 and if cJSON_Compare() is called on attacker-controlled JSON. Review application code for cJSON usage and compare versions. No specific network commands are available as this is a library-level issue.

Impact Analysis

An attacker could exploit this by providing a deeply nested JSON document that matches a reference document. When compared using cJSON_Compare(), the function would consume excessive CPU resources, causing a denial-of-service condition and potentially crashing the application.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling denial-of-service attacks through excessive CPU consumption. If an application processes attacker-controlled JSON data and uses cJSON_Compare(), it may become unresponsive, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade cJSON to version 1.7.20 or later to fix the algorithmic complexity flaw. If upgrading is not possible, audit and modify code to avoid using cJSON_Compare() on untrusted input or implement depth limits.

Hi! I’m here to help you understand CVE-2026-67216. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70