Description
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
Published: 2026-10-24
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an uncontrolled recursion in crow::json::load() which parses JSON requests. An attacker can send a payload with thousands of nested JSON objects that exhaust the worker thread stack, causing the server process to crash and all connections to drop, thereby denying service. This requires no authentication and is classified as CWE-674.

Affected Systems

CrowCpp's Crow library versions before 1.3.4, which are used in any application running a Crow HTTP server.

Risk and Exploitability

The CVSS score of 8.7 signifies high severity. The EPSS score is not available, but the attack can be performed remotely without authentication by sending a deeply nested JSON body. The vulnerability is not listed in CISA KEV, indicating no known exploited instances yet. Nonetheless, the impact of a server crash makes it a significant risk for services requiring high availability.

Generated by OpenCVE AI on October 24, 2026 at 12:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Crow to version 1.3.4 or later to apply the fixed JSON parsing logic.
  • As a temporary workaround, enforce strict limits on the depth or size of JSON payloads processed by the application, or reject requests that exceed safe thresholds.
  • After upgrading or applying limits, restart the application and monitor for abnormal process terminations to confirm remediation.

Generated by OpenCVE AI on October 24, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
Title Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
First Time appeared Crowcpp
Crowcpp crow
Weaknesses CWE-674
CPEs cpe:2.3:a:crowcpp:crow:*:*:*:*:*:*:*:*
Vendors & Products Crowcpp
Crowcpp crow
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Crowcpp Crow
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-24T11:40:30.179Z

Reserved: 2026-10-24T11:23:54.190Z

Link: CVE-2026-116011

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-24T12:16:57.070

Modified: 2026-10-24T12:16:57.070

Link: CVE-2026-116011

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T12:30:08Z

Weaknesses