CVE-2026-90715: Gravity JSON Parser Integer Overflow RCE

CVE-2026-90715 Overview

CVE-2026-90715 is an integer overflow vulnerability [CWE-189] in the Gravity programming language project by marcobambini. The flaw resides in the src/utils/gravity_json.c file within the UDP JSON parser component. Affected versions include Gravity up to and including 0.9.7. Attackers can trigger the overflow remotely without authentication by supplying crafted JSON input to the parser. The issue has been disclosed publicly, increasing the risk of opportunistic exploitation against exposed services embedding the Gravity runtime. Upgrading to version 0.9.8 remediates the vulnerability through commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2.

Critical Impact
Remote attackers can trigger an integer overflow in the Gravity JSON parser to corrupt parser state, potentially causing denial of service or memory-safety violations in embedding applications.

Affected Products

marcobambini Gravity versions up to and including 0.9.7
The udp json-parser component within src/utils/gravity_json.c
Applications embedding the Gravity scripting runtime prior to 0.9.8

Discovery Timeline

2026-09-14 - CVE CVE-2026-90715 published to NVD
2026-09-14 - Last updated in NVD database
Patch commit - 9b337c3eae5833c3956bed1fc01c21c14fd443f2 merged via Pull Request #451 and released in Gravity 0.9.8

Technical Details for CVE-2026-90715

Vulnerability Analysis

The vulnerability is an integer overflow in Gravity's JSON parsing routines located in src/utils/gravity_json.c. The parser processes untrusted JSON payloads and performs arithmetic on length or size values without adequate bounds checking. When an attacker supplies a JSON document with sufficiently large numeric fields or size specifiers, arithmetic wraps around, producing undersized allocations or misaligned buffer indexing. Downstream operations then read or write beyond intended limits. Because the parser is exposed via a UDP-facing entry point, an attacker can deliver a single crafted datagram to reach the vulnerable code path.

Root Cause

The root cause is missing validation of arithmetic operations on parsed JSON size values inside gravity_json.c. Values computed from attacker-controlled input can exceed the range of the destination integer type, wrapping to a small or negative number. The patch introduces a hardened JSON executable loader and scanner along with new bounds tests under test/loadbuffer/json_bounds.c.

Attack Vector

Exploitation requires network access to a service that ingests JSON through the Gravity parser over UDP. No authentication or user interaction is required. The attacker sends a single malformed JSON payload to trigger the overflow, resulting in parser corruption or process termination in the embedding application.

text

// Patch artifact – additions to .gitignore and Makefile introduce
// a dedicated JSON bounds test binary as part of the hardening fix.

// .gitignore
 *.x86_64
 *.hex
 gravity
+jsontest

// Makefile
 OPT_DIR = src/optionals/
 GRAVITY_SRC = src/cli/gravity.c
 EXAMPLE_SRC = examples/example.c
+JSONTEST_SRC = test/loadbuffer/json_bounds.c

Source: GitHub Commit 9b337c3

Detection Methods for CVE-2026-90715

Indicators of Compromise

Unexpected crashes, segmentation faults, or restarts in processes embedding Gravity <= 0.9.7
Inbound UDP traffic containing unusually large JSON numeric fields, oversized arrays, or deeply nested structures targeting the parser endpoint
Presence of Gravity binaries or libraries built from versions prior to 0.9.8 in production inventories

Detection Strategies

Inventory hosts and container images for the Gravity runtime and compare installed versions against 0.9.8
Inspect application logs for JSON parse errors, aborts, or abnormal termination signals originating from gravity_json.c code paths
Deploy network signatures on UDP flows delivering JSON payloads with anomalously large length or size fields

Monitoring Recommendations

Alert on repeated process restarts of services that expose Gravity JSON parsing over the network
Monitor UDP listeners hosting Gravity-based services for high volumes of malformed JSON from a single source
Track software bill of materials (SBOM) updates to confirm Gravity dependencies have been rebuilt against 0.9.8

How to Mitigate CVE-2026-90715

Immediate Actions Required

Upgrade all Gravity installations to version 0.9.8 or later, which contains commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2
Rebuild and redeploy any downstream applications or firmware that statically link the Gravity library
Restrict network exposure of UDP endpoints handling JSON input to trusted sources until patching is complete

Patch Information

The fix is delivered in Gravity release 0.9.8 via Pull Request #451 addressing Issue #447. The commit hardens the JSON executable loader and scanner and adds bounds testing under test/loadbuffer/json_bounds.c. See the Gravity project repository for source and build instructions.

Workarounds

Place the UDP JSON parser behind a network filter that rejects oversized or malformed JSON datagrams
Enforce strict size limits on inbound JSON payloads at the application layer before invoking the Gravity parser
Disable UDP-based JSON ingestion features until the upgrade to 0.9.8 has been validated

bash

# Example: rate-limit and size-restrict UDP JSON traffic with iptables
# (replace <PORT> with the port hosting the Gravity JSON listener)
iptables -A INPUT -p udp --dport <PORT> -m length --length 0:1024 \
  -m limit --limit 20/second --limit-burst 40 -j ACCEPT
iptables -A INPUT -p udp --dport <PORT> -j DROP