{"id":"CVE-2026-116620","kind":"vulnerability","aliases":["CVE-2026-116620"],"related":[],"title":"RapidJSON: out-of-bounds read in regex parser lets remote attackers leak memory","description":"A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"RapidJSON, a C++ JSON library, has an out-of-bounds read in its regex parser stream code (GenericStringStream::Take in include/rapidjson/stream.h) affecting versions up to 1.1.0. The exploit is public, and an attacker can trigger it remotely, which may expose adjacent process memory.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","package","rapidjson","self-hosted"],"not_affected_if":["no-regex-use","rapidjson-not-used"],"how_to_check":"- Check whether the project vendors RapidJSON: search for `include/rapidjson/stream.h` or `rapidjson` in your dependency manifests and CMake/Conan files\n- Confirm the version in use; affected versions are `1.1.0` and earlier, and the sources do not say which version is fixed\n- Check whether your application parses untrusted input with RapidJSON's regex features (`GenericRegex`, `Regex`)","fix":"- No fixed version is stated in the sources; the project had not responded when the issue was reported\n- Until a patch exists, avoid passing untrusted input to RapidJSON's regex parser, or switch to another JSON library\n- Watch the upstream repository (Tencent/rapidjson) for a release after `1.1.0`","status":"open","published_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:19+00:00","updated_at":"2026-10-27T01:36:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T01:36:19Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is stated in the sources; the project had not responded when the issue was reported\n- Until a patch exists, avoid passing untrusted input to RapidJSON's regex parser, or switch to another JSON library\n- Watch the upstream repository (Tencent/rapidjson) for a release after `1.1.0`","reach":"internet","title":"RapidJSON: out-of-bounds read in regex parser lets remote attackers leak memory","impact":"medium","summary":"RapidJSON, a C++ JSON library, has an out-of-bounds read in its regex parser stream code (GenericStringStream::Take in include/rapidjson/stream.h) affecting versions up to 1.1.0. The exploit is public, and an attacker can trigger it remotely, which may expose adjacent process memory.","category":"package","nicknames":[],"who_cares":["c++","rapidjson","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker reads adjacent process memory via crafted input","analyst_note":"Confirm which code paths reach GenericStringStream::Take, whether plain JSON parsing is affected, and whether the upstream project has published a fixed version.","how_to_check":"- Check whether the project vendors RapidJSON: search for `include/rapidjson/stream.h` or `rapidjson` in your dependency manifests and CMake/Conan files\n- Confirm the version in use; affected versions are `1.1.0` and earlier, and the sources do not say which version is fixed\n- Check whether your application parses untrusted input with RapidJSON's regex features (`GenericRegex`, `Regex`)","needs_analyst":true,"not_affected_if":["no-regex-use","rapidjson-not-used"],"who_is_affected":"Applications that use RapidJSON up to version 1.1.0 and feed untrusted input into its regex functionality are the exposed ones. The sources do not say whether plain JSON parsing without regex is affected, so teams that only parse JSON without regex features should verify that before deciding urgency.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":3361,"output_tokens":743,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116620':17A,20A '-2026':16A,19A '1.1.0':53B,82C 'adjac':68B 'affect':49B,85C 'attack':12A,60B,110C 'bound':5A,37B,107C 'c':21B,29B 'code':44B 'compon':97C 'cve':15A,18A 'detect':76C 'disclos':119C 'earli':132C 'exploit':55B,116C 'expos':67B 'function':87C 'genericstringstream':45B,88C 'host':26B 'include/rapidjson/stream.h':48B,94C 'inform':128C 'initi':113C 'issu':84C,135C 'json':30B 'lead':102C 'leak':13A 'let':10A 'librari':31B,93C 'manipul':101C 'may':66B,122C 'memori':14A,70B 'out-of-bound':2A,34B,104C 'packag':22B 'parser':9A,42B,99C 'problem':131C 'process':69B 'project':126C 'public':57B,120C 'rapidjson':1A,23B,27B,79C 'read':6A,38B,108C 'regex':8A,41B,98C 'remot':11A,64B,114C 'report':136C 'respond':140C 'secur':72C 'self':25B 'self-host':24B 'stream':43B 'take':46B,90C 'tencent':78C 'trigger':62B 'use':124C 'utf8':89C 'version':50B 'vulner':73C 'yet':141C","nicknames":[],"mitigations":[],"who_affected":"Applications that use RapidJSON up to version 1.1.0 and feed untrusted input into its regex functionality are the exposed ones. The sources do not say whether plain JSON parsing without regex is affected, so teams that only parse JSON without regex features should verify that before deciding urgency.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116620","severity":null,"published_at":"2026-10-27T01:19:06+00:00","modified_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}