Source: cjson Version: 1.7.19-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for cjson. CVE-2026-16554[0]: | cJSON library is vulnerable to an integer overflow in the | print_string_ptr() function in cJSON.c on 32-bit platforms. The | escape_characters counter, a 32-bit size_t, can wrap around when | processing strings containing approximately 858,993,460 or more | control characters, causing the output buffer to be allocated based | on an underestimated length. When cJSON_PrintBuffered() is used with | a pre-allocated buffer, the subsequent write loop overflows the heap | allocation. An attacker supplying a crafted JSON string to an | application using cJSON on a 32-bit platform can cause a heap buffer | overflow, potentially leading to remote code execution, information | disclosure, or denial of service. Because project creator | contact attempts were unsuccessful, the vulnerability has only been | confirmed in version 1.7.19 but may also affect other versions. This probably should be reported in the upstream project as issue publicly as other issues have been responded to. The CNA claims that though contact were unsuccessful. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-16554 https://www.cve.org/CVERecord?id=CVE-2026-16554 [1] https://cert.pl/en/posts/2026/07/CVE-2026-16554 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
