CVE-2026-29975
High · 7.5CVSS
7.5
EPSS
0.8%
Published
May 8, 2026
CISA due date
—
The record
lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson_stream.c). The end-of-string detection logic incorrectly identifies escaped quote characters by only checking the immediately preceding character rather than counting consecutive backslashes, causing valid JSON strings ending with an escaped backslash (like "\\") to never terminate parsing. A remote attacker can send well-formed JSON to cause applications using lwjson_stream_parse() to hang indefinitely, resulting in denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-110354 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of… CWE-835
- CVE-2026-113794 pypdf is a free and open-source pure-python PDF library. CWE-835
- CVE-2026-113792 pypdf is a free and open-source pure-python PDF library. CWE-835
- CVE-2026-113793 pypdf is a free and open-source pure-python PDF library. CWE-835
- CVE-2026-112406 Pillow is a Python imaging library. CWE-835
- CVE-2026-112391 Pillow is a Python imaging library. CWE-835
- CVE-2026-112390 Pillow is a Python imaging library. CWE-835
- CVE-2026-101895 Angular is a development platform for building mobile and desktop web applications using… CWE-835