Crow: Denial of service via deeply nested JSON in crow::json::load()

Summary

Crow, a C++ framework for HTTP and WebSocket services, contains an uncontrolled recursion flaw (CWE-674) in crow::json::load(). A remote, unauthenticated attacker can send a request body with thousands of nested JSON objects, exhausting the worker thread stack. The server process then terminates and all open connections are dropped. Only availability is affected, and exposure depends on whether an application built with Crow parses untrusted JSON.

Affected

• Crow versions before 1.3.4 (CVE record: affected 0 to < 1.3.4)
• CVSS 4.0 base score 8.7 (HIGH) as provided; NVD analysis pending at time of writing

Fixed in

• Upgrade to Crow 1.3.4 or later (fix commit 6956b7c, limits JSON parser depth to 1024)
• Check the Crow releases page for the latest stable version before choosing a target

Workaround

• No vendor workaround known; the fix is an upgrade
• Until upgraded: limit request body size and JSON nesting at a reverse proxy or WAF, restrict JSON endpoints, and configure automatic restart of the service

Exploitation

• No confirmed in-the-wild exploitation; not listed as known exploited
• CISA SSVC: exploitation none, automatable yes, technical impact partial
• Public proof-of-concept status is unverified; treat exploitation as possible

Our recommendation

• Inventory all Crow usage (source code, Conan, vcpkg, binaries) and identify internet-facing instances
• Upgrade to version 1.3.4 or later and verify the deployed version
• Restrict exposure of JSON endpoints and monitor for service crashes and restarts until patched

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  D7EAD/CVE-2026-116011

Research sources

• GitHub Security Advisory GHSA-7x84-xhp8-6cqj github.com
• VulnCheck advisory: Crow before 1.3.4 DoS via deeply nested JSON www.vulncheck.com
• Crow release v1.3.4 github.com
• Fix commit 6956b7c: JSON parser depth limit github.com
• Crow json.h at v1.3.3 github.com
• VulDB entry 426108 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:21.