cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking…

cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments

cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal

parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character

Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE

Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE

Integer Overflow Leading to Heap Buffer Overflow in cJSON

cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding

cJSON cJSON_Compare Exponential Complexity Denial of Service

cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c

DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions

Dave Gamble cJSON version 1.7.6 and earlier contains a CWE-772 vulnerability in cJSON library that can result in Denial of Service (DoS)

DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free

cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation