CrowCpp vulnerabilities
We track 4 vulnerabilities in CrowCpp products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 24, 2026.
Latest CrowCpp vulnerabilities
- 7.5 High severity
Crow: Uncontrolled Recursion
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhau
- 7.5 High severity
Crow: Use of Uninitialized Resource
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB.
- 9.8 Critical severity
Crow: Use After Free
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HTTP pipelining, but the asynchronous Connection layer is unaware of HTTP pipelining. Specifically, the
- 9.8 Critical severity
Crow: Off-by-one Error
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers to remotely execute arbitrary code in the context of the vulnerable service.