CVE-2026-116011

HighCVSS 7.5

Published: 24/10/2026(UTC)Updated: 26/10/2026(UTC)Translated: 24/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.68%

52th percentile - higher than 52% of all known CVEs

Summary

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.

Risk Assessment

A remote unauthenticated attacker can crash the server and drop all connections, causing a denial of service. The risk affects any Crow-based application that accepts JSON from untrusted clients.

Recommendation

Update Crow to version 1.3.4 or later. Until then, consider limiting JSON nesting depth at the proxy level.

Other vulnerabilities in Crow

CVE-2023-26142Medium
All versions of the crow package are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. The set_header and add_header functions do not properly sanitize header values against CRLF injection, allowing an attacker to add \r\n characters and inject malicious content.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS