{"id":"CVE-2026-116011","title":"Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()","summary":"Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-674"],"vendor":"CrowCpp","product":"Crow","affected":["Crow < 1.3.4"],"published":"2026-10-24","updated":"2026-10-24","sourceUpdated":"2026-10-24T11:40:30.179Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116011","references":[{"url":"https://github.com/CrowCpp/Crow/security/advisories/GHSA-7x84-xhp8-6cqj","label":"GitHub Security Advisory (GHSA-7x84-xhp8-6cqj)"},{"url":"https://github.com/CrowCpp/Crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b"},{"url":"https://github.com/CrowCpp/Crow/releases/tag/v1.3.4","label":"Crow v1.3.4 Release Notes"},{"url":"https://github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878"},{"url":"https://www.vulncheck.com/advisories/crow-before-1.3.4-denial-of-service-via-deeply-nested-json-in-crow-json-load","label":"VulnCheck Advisory: Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()"}],"tags":["cve.org"],"ingestedAt":"2026-10-24T11:57:47.030Z","slug":"CVE-2026-116011","body":"## Overview\n\nCrow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.\n\n## Affected\n\n- `Crow < 1.3.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}