Vulnerability feed

Executive summary

The advisory says Crow versions before 1.3.4 contain an uncontrolled recursion flaw in the crow::json::load() function that lets a remote, unauthenticated attacker crash the server by sending deeply nested JSON. The text provided is truncated and does not state a severity score. The advisory does not state a vendor recommendation beyond the fixed version 1.3.4 in the description.

Technical summary

The flaw is classified as uncontrolled recursion in crow::json::load(), triggered by sending deeply nested JSON to a server, which can exhaust the stack and crash the process. The attack requires only remote, unauthenticated access as described. The affected range is stated as before 1.3.4, so 1.3.4 is the fixed version named. The source code excerpt shows a max_depth constant of 10000 in the parser, but the advisory does not explicitly state that this check is the fix or explain its effect. No workaround, CVSS score, exploitation status, or detection guidance is stated in the provided text.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

CrowCppCrowCrowCpp CrowCrow