CVE-2026-116011

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-116011
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116011.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-116011
Aliases
  • GHSA-7x84-xhp8-6cqj
Published
2026-10-24T11:40:30Z
Modified
2026-10-25T07:11:30Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
Details

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116011.json"
}
References

Affected packages

Git / github.com/crowcpp/crow

Affected ranges

Type
GIT
Repo
https://github.com/crowcpp/crow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
54877af2d45bc4baeaabbf06b824e041a2faafb3
Fixed
6956b7ca93c5df22f5aaccd670e5aa000c0d882b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.3.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "6956b7ca93c5df22f5aaccd670e5aa000c0d882b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.3.4",
            "range": [
                {
                    "fixed": "54877af2d45bc4baeaabbf06b824e041a2faafb3"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.2
v0.*
v0.1
v0.3
v1.*
v1.3.0
v1.3.0.0
v1.3.1
v1.3.2
v1.3.2.0
v1.3.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116011.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "106235165500552742981564507882710865087",
                "257356871027664299424711655007526478012",
                "103491032729947620148360026250674695861",
                "201530669038425920321609123497143320489",
                "217242225783498483146456099853122272838",
                "291401363098383295768199300217427595582",
                "190089752248309007313015103040808448578",
                "229974090790382730621145564384927107510"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-116011-0b352127",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/crowcpp/crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b",
        "target": {
            "file": "include/crow/json.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "285328054012781063939655918243792079400",
            "length": 5005
        },
        "id": "CVE-2026-116011-edcc6979",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/crowcpp/crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b",
        "target": {
            "file": "include/crow/json.h",
            "function": "load_nocopy_internal"
        }
    }
]
vanir_signatures_modified 
"2026-10-25T07:11:30Z"