CVE-2026-67216

Name of the Vulnerable Software and Affected Versions cJSON versions prior to 1.7.20

Description An inefficient algorithmic complexity flaw exists in the cJSON Compare() function. When comparing objects, the function recurses into each shared subtree twice without a depth guard, resulting in exponential running time relative to the nesting depth. A small, deeply nested JSON document of a few hundred bytes with a depth of approximately 40 can consume hours of CPU time, with the processing cost doubling for each additional nesting level. An attacker can trigger a denial-of-service condition by providing a structurally equal JSON document that influences the execution of the cJSON Compare() function.

Recommendations Update to version 1.7.20 or later. As a temporary workaround, restrict the use of the cJSON Compare() function on untrusted or attacker-influenced JSON data.