Live › vulnerability › CVE-2026-116011
Go to dashboardCrow's crow::json::load() parses deeply nested JSON with unbounded recursion, so a request body with thousands of nested objects exhausts the worker thread stack. An unauthenticated remote attacker can terminate the process and drop all its connections.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 12:47 UTC. All times on this page are UTC.
Applications built on Crow versions before 1.3.4 that call crow::json::load() on untrusted request bodies are exposed, since any remote client can send the payload. Services that do not parse JSON from untrusted input, or that run an upgraded version, can skip it.
No product ranges from the sources yet.
unknown otherwise.crow::json::load( that parse request bodies.1.3.4 or later.crow::json::load().Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
This page as .md · .json · in your agent: get_signal("CVE-2026-116011")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.