Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Crowcpp Crow
cpe:2.3:a:crowcpp:crow:*:*:*:*:*:*:*:*
|
— |
1.3.4
|
References 5
https://github.com/CrowCpp/Crow/security/advisories/GHSA-7x84-xhp8-6cqj
GitHub Security Advisory (GHSA-7x84-xhp8-6cqj)
https://github.com/CrowCpp/Crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b
NVD
https://github.com/CrowCpp/Crow/releases/tag/v1.3.4
Crow v1.3.4 Release Notes
https://github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878
NVD
https://www.vulncheck.com/advisories/crow-before-1.3.4-denial-of-service-via-de…
VulnCheck Advisory: Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()