CVE-2026-67216: davegamble cjson Inefficient Algorithmic Complexity

Vulnerability summary

CVE-2026-67216 is a high (CVSS 8.2) Inefficient Algorithmic Complexity vulnerability in davegamble cjson. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 49.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-07-2026
   PublishedVulnerability first disclosed.
2. 30-07-2026
   Last modifiedVulnerability information updated.

Description

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.

• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.