DaveGamble vulnerabilities
We track 6 vulnerabilities in DaveGamble products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 10, 2026.
Latest DaveGamble vulnerabilities
- 7.3 High severity
cJSON: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public
- 7.5 High severity
cJSON: Use of Incorrectly-Resolved Name or Reference
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys b
- 7.5 High severity
cJSON: Inefficient Algorithmic Complexity
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesti
- 7.5 High severity
cJSON: Uncontrolled Recursion
cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts
- 7.8 High severity
cJSON: Integer Overflow or Wraparound
cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control c
- 9.8 Critical severity
Cjson: Out-of-bounds Read
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanu