{"id":"CVE-2026-116011","kind":"vulnerability","aliases":["CVE-2026-116011"],"related":[],"title":"Crow: deeply nested JSON request crashes the server process","description":"Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.","summary":"Crow's crow::json::load() parses deeply nested JSON with unbounded recursion, so a request body with thousands of nested objects exhausts the worker thread stack. An unauthenticated remote attacker can terminate the process and drop all its connections.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","crow","package","poc-public","self-hosted","web-api"],"not_affected_if":["no-untrusted-json-parsing","upgraded-to-1.3.4"],"how_to_check":"- Check the Crow version in the project's dependency manifest or vendored headers; `unknown` otherwise.\n- Search the codebase for calls to `crow::json::load(` that parse request bodies.","fix":"- Upgrade Crow to `1.3.4` or later.\n- Until upgraded, reject or size-limit request bodies before calling `crow::json::load()`.","status":"open","published_at":"2026-10-24T12:16:57+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","triaged_at":"2026-10-25T02:59:58+00:00","updated_at":"2026-10-25T02:59:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T02:59:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Crow to `1.3.4` or later.\n- Until upgraded, reject or size-limit request bodies before calling `crow::json::load()`.","reach":"internet","title":"Crow: deeply nested JSON request crashes the server process","impact":"medium","summary":"Crow's crow::json::load() parses deeply nested JSON with unbounded recursion, so a request body with thousands of nested objects exhausts the worker thread stack. An unauthenticated remote attacker can terminate the process and drop all its connections.","category":"package","nicknames":[],"who_cares":["c++","crow","self-hosted","web-api"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote unauthenticated crash of the server process, dropping all connections","analyst_note":"Public PoC exists at https://github.com/D7EAD/CVE-2026-116011; verify the PoC reproduces the crash and confirm the fixed version against the upstream Crow release notes.","how_to_check":"- Check the Crow version in the project's dependency manifest or vendored headers; `unknown` otherwise.\n- Search the codebase for calls to `crow::json::load(` that parse request bodies.","needs_analyst":true,"not_affected_if":["upgraded-to-1.3.4","no-untrusted-json-parsing"],"who_is_affected":"Applications built on Crow versions before 1.3.4 that call crow::json::load() on untrusted request bodies are exposed, since any remote client can send the payload. Services that do not parse JSON from untrusted input, or that run an upgraded version, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":3380,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116011':12A,15A '-2026':11A,14A '1.3.4':69C 'allow':80C 'api':27B 'attack':57B,83C,93C 'bodi':43B,98C 'c':16B 'connect':66B,116C 'contain':70C 'crash':6A,85C 'crow':1A,17B,28B,30B,67C,76C 'cve':10A,13A 'deepli':2A,34B,90C 'drop':63B,114C 'exhaust':49B,105C 'host':24B 'json':4A,31B,36B,77C,92C 'load':32B,78C 'nest':3A,35B,47B,91C,102C 'object':48B,103C 'packag':18B 'pars':33B 'poc':20B 'poc-publ':19B 'process':9A,61B,112C 'public':21B 'recurs':39B,73C 'remot':56B,81C 'request':5A,42B,97C 'self':23B 'self-host':22B 'send':89C,95C 'server':8A,87C 'stack':53B,109C 'termin':59B,110C 'thousand':45B,100C 'thread':52B,108C 'unauthent':55B,82C 'unbound':38B 'uncontrol':72C 'vulner':74C 'web':26B 'web-api':25B 'worker':51B,107C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Crow versions before 1.3.4 that call crow::json::load() on untrusted request bodies are exposed, since any remote client can send the payload. Services that do not parse JSON from untrusted input, or that run an upgraded version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T12:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-116011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116011","severity":null,"published_at":"2026-10-24T12:16:57+00:00","modified_at":"2026-10-24T12:16:57+00:00","first_seen_at":"2026-10-24T12:47:58+00:00","fetched_at":"2026-10-24T12:47:58+00:00","note":null},{"source":"github-poc","external_id":"D7EAD/CVE-2026-116011","url":"https://github.com/D7EAD/CVE-2026-116011","severity":null,"published_at":"2026-10-24T19:12:03+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:23:49+00:00","fetched_at":"2026-10-24T19:23:49+00:00","note":null}],"documents":[{"id":2939,"url":"https://github.com/D7EAD/CVE-2026-116011","title":"D7EAD/CVE-2026-116011","kind":"poc","source":"github","text":"A remote denial of service vulnerability in CrowCPP due to uncontrolled recursion.\n\nstars 0","published_at":"2026-10-24T19:12:03+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}