Description
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
CrowCpp Crow
Default version status: unaffected
0 to < 1.3.4affected
pkg:github/crowcpp/crowReferences
- https://github.com/CrowCpp/Crow/security/advisories/GHSA-7x84-xhp8-6cqj ↗
- https://github.com/CrowCpp/Crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b ↗
- https://github.com/CrowCpp/Crow/releases/tag/v1.3.4 ↗
- https://github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878 ↗
- https://www.vulncheck.com/advisories/crow-before-1.3.4-denial-of-service-via-deeply-nested-json-in-crow-json-load ↗