Researcher discloses 33 flaws in stagnant cJSON library

A security researcher has published details of 33 vulnerabilities in cJSON, one of the most widely used JSON parsers written in C, warning that development has been largely stagnant for four years and that no fixed release is available for downstream users.

According to Joshua Hu, the issues affect every version through v1.7.19 and remain in the current code. cJSON is commonly vendored into Espressif's ESP-IDF, embedded firmware, and a broad range of server-side C software. The first thirteen flaws are memory-safety problems and denial-of-service conditions. The rest are logic bugs that can silently lose data or operate on the wrong object member. Hu counts those as security-relevant in a library whose job includes applying external patch documents to local data.

Several of the problems had already been reported to the project, some years earlier and with working proofs of concept. Memory-safety reports sat open and unanswered, and in a few cases a patch that would have fixed the issue was left unmerged in the same report. "If you ship cJSON, you need to know what's in it, because nobody is going to hand you a fixed version," Hu wrote.

The writeup was circulated on the oss-security list. Hu also noted that some crashes only surface reliably when both AddressSanitizer and UndefinedBehaviorSanitizer are enabled together on an unoptimized build; partial sanitizer setups or higher optimization can make the library appear healthier than it is.