The vulnerability arises from improper input validation in lwjson's streaming JSON parser. The parser incorrectly handles escaped quote characters, only examining the preceding character rather than counting consecutive backslashes. This flaw maps to CWE‑835 (Infinite Loop). Consequently, JSON strings that end in an escaped backslash never terminate, causing the parser to loop indefinitely. A remote attacker can send a crafted, well‑formed JSON payload containing such a string to trigger an indefinite hang in any application that uses lwjson_stream_parse(), resulting in denial of service.

This defect is present in applications that link against lwjson version 1.8.1. The affected code resides in the lwjson_stream.c file of the lwjson project repository. No specific commercial vendors are listed, but any software that embeds this library at compile time is susceptible.

The CVE has a CVSS score of 7.5 and the EPSS score is not available. The vulnerability is not in the CISA KEV catalog, indicating no confirmed exploitation yet. The attack vector is inferred to be remote: a malicious JSON payload sent over a network interface can trigger the infinite loop, making the process unresponsive. The impact is limited to availability, but any service that cannot recover from a hung parsing routine faces significant disruption.