PT-2025-17394 · Cjson+3 · Cjson+3

Published 2025-04-19 · Updated 2026-03-11 · CVE-2023-26819

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions cJSON version 1.7.15

Description The issue might allow a denial of service via a crafted JSON document. For example, a document such as {"a": true, "b": [ null,9999999999999999999999999999999999999999999999912345678901234567]} could be used.

Recommendations For cJSON version 1.7.15, as a temporary workaround, consider validating JSON documents to prevent excessively large values in arrays, such as the b array in the example, until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-440

Related Identifiers

AZL-60883

AZL-60889

BDU:2025-09919

CVE-2023-26819

DLA-4216-1

OESA-2025-1965

OESA-2025-1992

OESA-2025-1993

OESA-2025-1994

OESA-2025-1995

OPENSUSE-SU-2025:15583-1

OPENSUSE-SU-2026:20340-1

SUSE-SU-2025:03520-1

USN-7973-1

Affected Products

Debian

Linuxmint

Ubuntu

Cjson

References · 47

• 🔥 https://github.com/boofish/json_bugs/tree/main/cjson · Exploit
• https://osv.dev/vulnerability/AZL-60889 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4216-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1992 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-57052 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26819 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20340-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60883 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-53154 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26819 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15583-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03520-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26819 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1993 · Vendor Advisory