CVE-2026-116011GHSA-7x84-xhp8-6cqj
Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
CrowCpp Crow
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.3.4CrowCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 24 Oct 2026, 11:40 UTCPublishedCVE List
- 24 Oct 2026, 13:15 UTCFirst reportBluesky: CVE posts
- 24 Oct 2026, 19:12 UTCExploit code publicGitHub proof-of-concept repositories
Reports 2
2 outlets mention it. Reports are not confirmation; each links to its source.
- D7EAD/CVE-2026-116011: A remote denial of service vulnerability in CrowCPP due to uncontrolled recursion.GitHub proof-of-concept repositories, 24 Oct 2026Exploit code
- @thehackerwire.bsky.social: 🟠 CVE-2026-116011 - High (7.5) Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that all... https://www.thehackerwire.com/vulnerability/CVE-Bluesky: CVE posts, 24 Oct 2026
Description
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
Text from CVE List
Affected versions 1
- Crowaffected: all versions before 1.3.4CVE List
References 5
- github.com/CrowCpp/Crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882bFixvia CVE List
- github.com/CrowCpp/Crow/releases/tag/v1.3.4Fixvia CVE List
- github.com/CrowCpp/Crow/security/advisories/GHSA-7x84-xhp8-6cqjAdvisoryvia CVE List
- vulncheck.com/advisories/crow-before-1.3.4-denial-of-service-via-deeply-nested-json-in-crow-json-loadAdvisoryvia CVE List
- github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878Referencevia CVE List