PT-2026-39144 · Lwjson · Lwjson

Dwilliams27 · Published 2026-05-08 · Updated 2026-05-10 · CVE-2026-29975

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lwjson version 1.8.1

Description Improper input validation in the streaming JSON parser (lwjson stream.c) occurs because the end-of-string detection logic incorrectly identifies escaped quote characters. The system only checks the immediately preceding character instead of counting consecutive backslashes, which prevents valid JSON strings ending with an escaped backslash from terminating parsing. A remote attacker can send well-formed JSON to cause applications using the lwjson stream parse() function to hang indefinitely, leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-29975

Affected Products

Lwjson

References · 5

• 🔥 https://gist.github.com/dwilliams27/b99fd41be5d6848691797042cbfc1103 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29975 · Security Note
• https://github.com/MaJerle/lwjson/blob/develop/lwjson/src/lwjson/lwjson_stream.c#L362-L364 · Note
• https://github.com/MaJerle/lwjson/tree/develop · Note
• https://twitter.com/CVEnew/status/2053559178606604583 · Twitter Post