CVE-2026-67216 Overview
CVE-2026-67216 is an algorithmic complexity vulnerability [CWE-407] in the cJSON library through version 1.7.19. The flaw resides in the cJSON_Compare() function, which recurses into each shared subtree twice with no depth guard. This produces exponential runtime relative to nesting depth. A crafted JSON document of only a few hundred bytes, nested to approximately 40 levels, can consume hours of CPU time. Each additional level of nesting roughly doubles the processing cost. Any application that invokes cJSON_Compare() on attacker-influenced JSON structurally equal to a reference document faces a denial-of-service condition.
Critical Impact
A few hundred bytes of deeply nested JSON can exhaust CPU resources for hours, disabling services that use cJSON_Compare() on untrusted input.
Affected Products
- cJSON library versions through 1.7.19
- Applications embedding cJSON that call cJSON_Compare() on external JSON
- Downstream software linking against vulnerable cJSON releases
Discovery Timeline
- 2026-07-29 - CVE-2026-67216 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-67216
Vulnerability Analysis
The vulnerability is an algorithmic complexity denial-of-service issue classified under [CWE-407]. cJSON_Compare() is intended to determine whether two JSON structures are equal. When the function walks through an object or array, it recurses into each matching child pair. Because comparison logic revisits each shared subtree twice, once in each traversal direction, and applies no depth or work limit, the total work grows exponentially with nesting depth. This behavior converts a small structurally equal document into a long-running CPU task.
A test document with nesting depth around 40 can occupy a single core for hours. Because runtime doubles per additional level, an attacker can select depth to match desired impact without inflating payload size. Requests remain small enough to bypass simple size-based rate limits.
Root Cause
The root cause is unbounded double recursion inside the comparison routine in cJSON.c. The function does not memoize traversed nodes, cap recursion depth, or short-circuit repeated work. Structural equality between the two inputs is required to trigger the worst case, since diverging subtrees would allow early exit.
Attack Vector
Exploitation requires network-reachable code paths that pass attacker-controlled JSON into cJSON_Compare() against a reference structure. Authentication is not required in typical exposure scenarios. The attacker submits a compact, deeply nested JSON document engineered to match the reference schema. Each request ties up a worker thread for an extended period, degrading availability of the host service.
Refer to the cJSON source in the vulnerable range, Joshua's cJSON CVE analysis, and the VulnCheck cJSON DoS advisory for technical details.
Detection Methods for CVE-2026-67216
Indicators of Compromise
- Sustained high CPU on processes linked against cJSON with stacks parked in cJSON_Compare or its internal comparators.
- Requests carrying JSON bodies with unusually deep nesting relative to the application's normal schema.
- Worker thread starvation and elevated request latency following small JSON POSTs.
Detection Strategies
- Profile services embedding cJSON and flag long-running invocations of cJSON_Compare() using CPU sampling or perf traces.
- Inspect inbound JSON at the application edge and reject payloads whose bracket nesting exceeds a defined threshold.
- Correlate spikes in per-request CPU time with static JSON body sizes to surface algorithmic-complexity abuse.
Monitoring Recommendations
- Alert on sudden increases in average request handling time for endpoints that consume JSON.
- Track thread pool saturation and queue depth on API gateways fronting cJSON-based services.
- Log JSON parse depth and comparison durations for endpoints that invoke equality checks.
How to Mitigate CVE-2026-67216
Immediate Actions Required
- Inventory applications that link against cJSON 1.7.19 or earlier and identify code paths calling cJSON_Compare().
- Reject JSON inputs exceeding a strict nesting depth (for example, 32) at ingress before invoking cJSON.
- Apply per-request CPU time and wall-clock limits to handlers that process untrusted JSON.
- Avoid using cJSON_Compare() on attacker-influenced inputs until a patched release is deployed.
Patch Information
No fixed cJSON version was listed in the NVD entry at the time of publication. Monitor the upstream cJSON repository for a release addressing the exponential comparison behavior, and consult the VulnCheck advisory for updates on remediation guidance.
Workarounds
- Replace cJSON_Compare() with a locally maintained iterative comparator that enforces a depth cap and total work budget.
- Pre-validate JSON with a schema that constrains maximum depth and array or object cardinality.
- Isolate JSON comparison work in a sandboxed process with strict RLIMIT_CPU controls to contain resource exhaustion.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
