CVE-2016-4425

Published: May 17, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.

Affected (1)

Products: Jansson Project: Jansson

Jansson Project

1 product

Jansson

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jansson Project Jansson	Up to 2.7

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-674

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (14)

http://www.debian.org/security/2015/dsa-3577

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/05/01/5

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/05/02/1

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/05/03/3

Source: cve@mitre.org

https://github.com/akheron/jansson/issues/282

Source: cve@mitre.org

Patch

https://github.com/akheron/jansson/pull/284

Source: cve@mitre.org

Patch

https://github.com/akheron/jansson/pull/284/commits/64ce0ad3731ebd77e02897b07920eadd0e2cc318

Source: cve@mitre.org

http://www.debian.org/security/2015/dsa-3577