Vulnerability · Published Oct 24, 2026 · Assigned by VulnCheck

CVE-2026-116011Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

High 7.5

In plain English

A high-severity security flaw in Crow from CrowCpp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 47.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.

Affected products (as reported)

Vendor	Product	Versions
CrowCpp	Crow	0 – before 1.3.4

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-7x84-xhp8-6cqj) vendor-advisory
https://github.com/CrowCpp/Crow/commit/6956b7ca93c5df22f5aaccd670e5aa000c0d882b patch
Crow v1.3.4 Release Notes release-notes
https://github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878 technical-description
VulnCheck Advisory: Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load() third-party-advisory