Uncontrolled Recursion in Crow - #VU147367
Published: September 8, 2026
Vulnerability identifier: #VU147367
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the crow::json::load() JSON parser when processing deeply nested JSON request bodies. A remote attacker can send a specially crafted request containing deeply nested JSON objects to cause a denial of service.
The issue can terminate the entire server process on Windows when the recursion exhausts available stack space.
Affected software
Crow
Remediation
Install security update from vendor's website.
Crow - update to 1.3.4