CVE-2022-24834

CVE-2022-24834 公開エクスプロイトの改良 著者 Conviso リサーチチーム 説明 Ricerca Security @RicercaSec のチームは、Redis に含まれる Lua インタプリタにおいて、興味深い脆弱性 CVE-2022-24834 を発見し、正常にエクスプロイトしました。この脆弱性は cjson ライブラリのヒープオーバーフローであり、詳細なレポートはこちらにあります。 いくつかのハードコードされたオフセット 2 3 に気づきました。これらはテストしたい人にとって不便になる可能性があるため、削除することにしました。主な目標は、より汎用的にし、Lua...

AlmaLinux 9.2 [TuxCare] Security Update: redis / redis-devel / redis-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752089153)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752089153 advisory. - Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflo...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. A specially crafted Lua script executed in Redis can trigger a heap overflow in the cjson library, leading to heap corruption and potentially remote code execution. This issue exists in all versions of Redis that support Lua scripting,...

Astra Linux – Vulnerability in cjson

It has been discovered that cJSON v1.7.16 contains a segmentation violation due to the use of the cJSONSetValuestring function in the cJSON.c file...

The vulnerability of the cJSON_Compare() function in the cJSON.c library for working with JSON objects in C language allows a attacker to cause a service denial.

The vulnerability of the cJSONCompare function in the cJSON.c library for working with JSON objects in C language is related to its inefficient algorithmic complexity. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerabilities of the functions cJSONUtils_ApplyPatches() and cJSONUtils_ApplyPatchesCaseSensitive() in the C language library for working with JSON objects in cJSON, which allow a hacker to trigger a service failure.

The vulnerabilities of the functions cJSONUtilsApplyPatches and cJSONUtilsApplyPatchesCaseSensitive in the C language JSON object handling library are related to uncontrolled recursion. Exploiting these vulnerabilities could allow an attacker to cause service failures...

UBUNTU-CVE-2026-67217

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

EUVD-2026-50329

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67216

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-67215 cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

Linux Distros Unpatched Vulnerability : CVE-2026-67216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree...

SUSE CVE-2026-16554

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

CVE-2026-16554

A flaw was found in the cJSON library. On 32-bit platforms, a specially crafted JSON string can cause an integer overflow in the printstringptr function. This vulnerability can lead to a heap buffer overflow, which an attacker could exploit to achieve remote code execution, disclose sensitive...

CVE-2026-16554

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

DEBIAN-CVE-2026-16554

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

UBUNTU-CVE-2026-16554

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

CVE-2026-16554

cJSON is a lightweight JSON parser/generator library. The vulnerability is an integer overflow in the print_string_ptr() function of cJSON.c on 32-bit platforms . The escape_characters counter (a 32-bit size_t) wraps around when a JSON string contains approximately 858,993,460 or more control cha...

CVE-2026-16554 Integer Overflow Leading to Heap Buffer Overflow in cJSON

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

CVE-2026-16554

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...