CVE-2026-116011— Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

Quick assessment

Affected

CrowCpp Crow

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Crow 1.3.4 之前的版本在函数中存在一个不受控的递归漏洞。该漏洞允许远程未认证的攻击者通过发送深度嵌套的 JSON 数据来导致服务器崩溃。攻击者可以发送包含数千层嵌套对象的请求体，从而耗尽工作线程的栈空间，导致进程终止并中断所有连接。

CVSS 7.5 · High Updated Oct 24, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
CrowCpp	Crow	`< 1.3.4`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

Source: CVE Program / CVE List V5

Vulnerability Description

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未经控制的递归

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
CrowCpp	Crow	0 ~ 1.3.4	-

II. Public POCs for CVE-2026-116011

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116011

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116011 (1)

🔗 json parsers parse depth limited to 1024 to prevent stack overflow · CrowCpp/Crow@6956b7c · GitHub Read full article patch

Vendor Advisories for CVE-2026-116011 (2)

https://www.cve.org/CVERecord?id=CVE-2026-116011

IV. Related Vulnerabilities

Same product: Crow

Same weakness: CWE-674