{"id":"CVE-2026-116011","title":"Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()","summary":"Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-674"],"vendor":"CrowCpp","product":"Crow","affected":["Crow < 1.3.4"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-26T15:43:59.203800Z"},"exploitAvailable":true,"published":"2026-10-24","updated":"2026-10-26","sourceUpdated":"2026-10-26T17:40:34.096Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116011","references":[{"url":"https://github.com/CrowCpp/Crow/security/advisories/GHSA-7x84-xhp8-6cqj","label":"GitHub Security Advisory (GHSA-7x84-xhp8-6cqj)"},{"url":"https://github.com/CrowCpp/Crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b"},{"url":"https://github.com/CrowCpp/Crow/releases/tag/v1.3.4","label":"Crow v1.3.4 Release Notes"},{"url":"https://github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878"},{"url":"https://www.vulncheck.com/advisories/crow-before-1.3.4-denial-of-service-via-deeply-nested-json-in-crow-json-load","label":"VulnCheck Advisory: Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()"}],"tags":["cve.org","exploit-available"],"epss":0.00683,"epssPercentile":0.52314,"exploits":{"github":1,"githubRepos":["https://github.com/D7EAD/CVE-2026-116011"],"checkedAt":"2026-10-27T16:59:05.178Z"},"ingestedAt":"2026-10-24T11:57:47.030Z","slug":"CVE-2026-116011","body":"## Overview\n\nCrow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.\n\n## Affected\n\n- `Crow < 1.3.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":229096,"id":"CVE-2026-116011","ts":1792904834327,"field":"exploit_available","old":"false","new":"true"}]}