CVE-2016-4425

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-05-17 · updated 2026-06-17
Weakness: CWE-20

Description

Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.

Affected products

Jansson Project Jansson: through 2.7

References

http://www.debian.org/security/2015/dsa-3577
http://www.openwall.com/lists/oss-security/2016/05/01/5
http://www.openwall.com/lists/oss-security/2016/05/02/1
http://www.openwall.com/lists/oss-security/2016/05/03/3
https://github.com/akheron/jansson/issues/282
https://github.com/akheron/jansson/pull/284
https://github.com/akheron/jansson/pull/284/commits/64ce0ad3731ebd77e02897b07920eadd0e2cc318
http://www.debian.org/security/2015/dsa-3577
http://www.openwall.com/lists/oss-security/2016/05/01/5
http://www.openwall.com/lists/oss-security/2016/05/02/1
http://www.openwall.com/lists/oss-security/2016/05/03/3
https://github.com/akheron/jansson/issues/282

Get alerted when CVE-2016-4425 or the next vulnerability affects your stack