---
id: "CVE-2026-116620"
kind: "vulnerability"
aliases: ["CVE-2026-116620"]
title: "RapidJSON: out-of-bounds read in regex parser lets remote attackers leak memory"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "package", "rapidjson", "self-hosted"]
not_affected_if: ["no-regex-use", "rapidjson-not-used"]
published_at: "2026-10-27T01:19:06+00:00"
first_seen_at: "2026-10-27T01:34:33+00:00"
updated_at: "2026-10-27T01:36:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116620", "first_seen_at": "2026-10-27T01:34:33+00:00"}]
---

# RapidJSON: out-of-bounds read in regex parser lets remote attackers leak memory

RapidJSON, a C++ JSON library, has an out-of-bounds read in its regex parser stream code (GenericStringStream::Take in include/rapidjson/stream.h) affecting versions up to 1.1.0. The exploit is public, and an attacker can trigger it remotely, which may expose adjacent process memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project vendors RapidJSON: search for `include/rapidjson/stream.h` or `rapidjson` in your dependency manifests and CMake/Conan files
- Confirm the version in use; affected versions are `1.1.0` and earlier, and the sources do not say which version is fixed
- Check whether your application parses untrusted input with RapidJSON's regex features (`GenericRegex`, `Regex`)

## Fix

- No fixed version is stated in the sources; the project had not responded when the issue was reported
- Until a patch exists, avoid passing untrusted input to RapidJSON's regex parser, or switch to another JSON library
- Watch the upstream repository (Tencent/rapidjson) for a release after `1.1.0`

## Timeline

- 2026-10-27T01:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116620

## From the sources

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_