The flaw resides in cJSON_Compare, an algorithm that recursively compares JSON objects. Internally it traverses each shared subtree twice, once for each direction, without limiting recursion depth. When an attacker supplies a deeply nested JSON document structurally equal to a trusted reference, the comparison consumes exponential CPU time, potentially taking hours for a document only a few hundred bytes in size. This overwhelmingly consumes processing resources and renders the application unusable, constituting a denial‑of‑service condition. The weakness is characterized by algorithmic complexity and resource exhaustion (CWE‑407, CWE‑770).

The bug affects the cJSON library maintained by DaveGamble, specifically any release through version 1.7.19. Systems employing cJSON in any form that may compare user‑supplied JSON against a known document are susceptible. Updated or later releases that fix the recursion guard are not affected.

The CVSS score of 8.2 reflects a high severity impact, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits have been documented. The likely attack vector involves an application that processes external JSON data and calls cJSON_Compare; an attacker would craft a deeply nested, equivalent document to trigger the denial‑of‑service.