CVE-2026-90715
Deferred Deferred - Pending Action

Integer Overflow in Gravity JSON Parser

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90715
EUVD
EUVD-2026-77440

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
marcobambini gravity to 0.9.7 (inc)
marcobambini gravity to 0.9.8 (exc)
marcobambini gravity 0.9.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-189
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in the Gravity programming language's JSON parser, specifically in the file src/utils/gravity_json.c. It occurs when parsing long sequences of digits in JSON integer literals, causing the parser to exceed the maximum value of a signed 64-bit integer. This leads to undefined behavior, potential crashes, or data corruption. The issue is present in versions up to 0.9.7 and is fixed in version 0.9.8.

Detection Guidance

This vulnerability is specific to the Gravity programming language's JSON parser and requires checking the version of Gravity installed on your system. Run 'gravity --version' to check if you are using a version prior to 0.9.8. If so, the system is vulnerable. Additionally, use static analysis tools like AddressSanitizer or UndefinedBehaviorSanitizer during compilation to detect memory safety issues in the JSON parser.

Impact Analysis

An attacker could exploit this vulnerability by sending maliciously crafted JSON data to trigger the integer overflow. This may cause the application to crash, execute arbitrary code, or corrupt data. Since the attack can be performed remotely, systems using vulnerable versions of Gravity are at risk if they process untrusted JSON input.

Compliance Impact

The vulnerability involves an integer overflow in a JSON parser, which could lead to undefined behavior, crashes, or data corruption. While not directly tied to GDPR or HIPAA, such vulnerabilities may compromise data integrity and confidentiality if exploited, potentially violating principles of secure data handling required by these regulations.

Mitigation Strategies

Upgrade Gravity to version 0.9.8 or later immediately. This version includes patches for the integer overflow and other memory safety issues in the JSON parser. Download the latest release from the official repository or apply the patch 9b337c3eae5833c3956bed1fc01c21c14fd443f2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90715. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart