CVE-2026-116011

Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.

Analysis

AI-generated

Technical impact

The vulnerability is an uncontrolled recursion in crow::json::load() which parses JSON requests. An attacker can send a payload with thousands of nested JSON objects that exhaust the worker thread stack, causing the server process to crash and all connections to drop, thereby denying service. This requires no authentication and is classified as CWE-674.

Affected Systems

CrowCpp's Crow library versions before 1.3.4, which are used in any application running a Crow HTTP server.

Risk and Exploitability

The CVSS score of 8.7 signifies high severity. The EPSS score is not available, but the attack can be performed remotely without authentication by sending a deeply nested JSON body. The vulnerability is not listed in CISA KEV, indicating no known exploited instances yet. Nonetheless, the impact of a server crash makes it a significant risk for services requiring high availability.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Crow to version 1.3.4 or later to apply the fixed JSON parsing logic.
  • As a temporary workaround, enforce strict limits on the depth or size of JSON payloads processed by the application, or reject requests that exceed safe thresholds.
  • After upgrading or applying limits, restart the application and monitor for abnormal process terminations to confirm remediation.

Generated by OpenCVE AI on October 24, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
Title Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
First Time appeared Crowcpp
Crowcpp crow
Weaknesses CWE-674
CPEs cpe:2.3:a:crowcpp:crow:*:*:*:*:*:*:*:*
Vendors & Products Crowcpp
Crowcpp crow
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Oct 26, 2026, 5:40 PM
Reserved
Oct 24, 2026, 11:23 AM

View source JSON

Updated
Oct 26, 2026, 3:44 PM

JSON

Status
Awaiting Analysis
Published
Oct 24, 2026, 12:16 PM
Modified
Oct 26, 2026, 6:39 PM

View source JSON

No data.

Updated
Oct 24, 2026, 1:45 PM

JSON