CVE-2024-31755: cJSON Buffer Overflow Vulnerability

CVE-2024-31755 Overview

CVE-2024-31755 is a NULL pointer dereference vulnerability in cJSON version 1.7.17, an ultralightweight JSON parser written in ANSI C. The flaw resides in the cJSON_SetValuestring function in cJSON.c, where passing a crafted value as the second parameter triggers a segmentation violation. Applications that embed cJSON and expose the affected function to untrusted input can be forced to crash, resulting in denial of service. The issue is classified under [CWE-476] (NULL Pointer Dereference) and affects any downstream software linked against the vulnerable release.

Critical Impact
Attackers with low-privilege access to an application using cJSON 1.7.17 can trigger a segmentation fault in cJSON_SetValuestring, causing the host process to terminate and disrupting service availability.

Affected Products

cJSON 1.7.17 (cjson_project:cjson)
Applications and libraries statically or dynamically linked against cJSON 1.7.17
Embedded firmware and IoT stacks bundling the affected cJSON.c source

Discovery Timeline

2024-04-26 - CVE-2024-31755 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31755

Vulnerability Analysis

The vulnerability lives in cJSON_SetValuestring, a helper that updates the string value stored inside a cJSON node. When the function is invoked with a crafted second argument, it dereferences a pointer without verifying that it references a valid memory region. The resulting segmentation violation terminates the process hosting the parser.

Because cJSON is embedded in a broad range of network services, IoT firmware, and desktop tools, the practical impact depends on where the affected function is reachable. Any code path that forwards attacker-controlled data into cJSON_SetValuestring inherits the crash primitive.

Root Cause

The root cause is missing input validation before pointer dereference. cJSON_SetValuestring assumes the target node and the incoming string are well-formed, and it does not check the type of the target item or the state of its internal string buffer before writing. When these preconditions fail, the function reads or writes through an invalid pointer, causing SIGSEGV.

Attack Vector

Exploitation requires network reachability to an application that exposes cJSON parsing on untrusted input and low-privilege authentication. An attacker sends JSON content that drives the program into calling cJSON_SetValuestring on a node whose value string is not a heap-allocated buffer of the expected type. The process crashes, producing a denial-of-service condition. No arbitrary code execution has been demonstrated for this issue.

The vulnerability is a NULL pointer dereference reachable through the second parameter of cJSON_SetValuestring. Refer to the upstream GitHub Issue Report for the reproduction details submitted by the reporter.

Detection Methods for CVE-2024-31755

Indicators of Compromise

Unexpected SIGSEGV or segmentation fault entries in application logs tied to processes that parse JSON with cJSON.
Core dumps whose faulting frame resolves to cJSON_SetValuestring in cJSON.c.
Repeated crashes or automatic restarts of a service after receiving malformed JSON payloads from a single source.

Detection Strategies

Perform a software composition analysis (SCA) sweep to enumerate binaries and containers that ship cJSON 1.7.17.
Instrument fuzzing harnesses around cJSON_SetValuestring with sanitizers (ASan, UBSan) to identify vulnerable call sites in first-party code.
Correlate web application firewall (WAF) or API gateway logs for anomalous JSON payloads followed by 5xx responses or connection resets.

Monitoring Recommendations

Alert on process crash telemetry for services that expose JSON APIs, including systemd Result=core-dump events and Windows Application Error entries.
Track abnormal restart rates for microservices and IoT agents parsing external JSON.
Monitor upstream advisories on the cJSON GitHub repository for a formal fix and release tag.

How to Mitigate CVE-2024-31755

Immediate Actions Required

Inventory every application, container image, and firmware bundle that links against cJSON 1.7.17.
Restrict access to endpoints that invoke cJSON_SetValuestring on attacker-controlled JSON until a patched build is deployed.
Enforce authentication and rate limiting on JSON APIs to reduce the exposure window for low-privilege denial-of-service attempts.

Patch Information

At the time of the last NVD update on 2026-06-17, no fixed release is listed in the NVD entry. Track the upstream GitHub Issue Report for the maintainer's patch and rebuild dependent software once a fixed version is published. Downstream distributions may backport the fix into 1.7.17 packages before a new upstream tag is cut.

Workarounds

Validate JSON input schema and reject payloads that attempt to overwrite string values on non-string nodes before invoking cJSON_SetValuestring.
Wrap calls to cJSON_SetValuestring with type checks using cJSON_IsString and verify the target node's valuestring pointer before modification.
Run affected services under a supervisor that isolates crashes, and consider replacing cJSON with an alternative parser for high-risk, internet-facing workloads.

bash

# Configuration example: identify vulnerable cJSON binaries on a Linux host
grep -R --include='*.c' -n 'cJSON_SetValuestring' /usr/src
strings /usr/lib/*/libcjson* 2>/dev/null | grep -i 'cJSON'
dpkg -l | grep -i cjson