{"id":"CVE-2026-116011","summary":"Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()","details":"Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.","aliases":["GHSA-7x84-xhp8-6cqj"],"modified":"2026-10-25T07:11:30.132758747Z","published":"2026-10-24T11:40:30.179Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116011.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116011.json"},{"type":"PACKAGE","url":"https://github.com/CrowCpp/Crow"},{"type":"ARTICLE","url":"https://github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878"},{"type":"FIX","url":"https://github.com/CrowCpp/Crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b"},{"type":"ADVISORY","url":"https://github.com/CrowCpp/Crow/releases/tag/v1.3.4"},{"type":"ADVISORY","url":"https://github.com/CrowCpp/Crow/security/advisories/GHSA-7x84-xhp8-6cqj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116011"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/crow-before-1.3.4-denial-of-service-via-deeply-nested-json-in-crow-json-load"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/crowcpp/crow","events":[{"introduced":"0"},{"fixed":"54877af2d45bc4baeaabbf06b824e041a2faafb3"},{"fixed":"6956b7ca93c5df22f5aaccd670e5aa000c0d882b"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"1.3.4"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"6956b7ca93c5df22f5aaccd670e5aa000c0d882b"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v1.3.4","range":[{"fixed":"54877af2d45bc4baeaabbf06b824e041a2faafb3"}]}]}}],"versions":["v1.3.3","v1.3.2.0","v1.3.2","v1.3.1","v1.3.0.0","v1.3.0","v0.3","0.2","v0.1"],"database_specific":{"vanir_signatures_modified":"2026-10-25T07:11:30Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116011.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["106235165500552742981564507882710865087","257356871027664299424711655007526478012","103491032729947620148360026250674695861","201530669038425920321609123497143320489","217242225783498483146456099853122272838","291401363098383295768199300217427595582","190089752248309007313015103040808448578","229974090790382730621145564384927107510"],"threshold":0.9},"id":"CVE-2026-116011-0b352127","signature_type":"Line","signature_version":"v1","source":"https://github.com/crowcpp/crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b","target":{"file":"include/crow/json.h"}},{"id":"CVE-2026-116011-edcc6979","signature_type":"Function","signature_version":"v1","source":"https://github.com/crowcpp/crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b","target":{"file":"include/crow/json.h","function":"load_nocopy_internal"},"deprecated":false,"digest":{"length":5005,"function_hash":"285328054012781063939655918243792079400"}}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}