CVE-2026-116011VulnerabilityPublished 10/24/2026

CVE-2026-116011: Uncontrolled Recursion in CrowCpp Crow

Affects CrowCpp CrowSource CVE Database V5

CVSS 4.0 base score

8.7High

Exploitation: Not in CISA KEV, no exploitation reported

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What to do

AI-suggested

A fix is available in Crow version 1.3.4. Users should upgrade to version 1.3.4 or later to remediate this vulnerability.

Affected software

Product	Affected	Fixed in
CrowCppCrow	Affected >=0 <1.3.4	Fixed in 1.3.4
GitHub ActionsCrow`pkg:github/Crow`Other threats	Affected >=0 <1.3.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

CVE-2026-116011 is a high-severity vulnerability in Crow versions before 1.3.4. It involves uncontrolled recursion in the crow::json::load() function, which can be triggered by sending deeply nested JSON objects. This causes the server's worker thread stack to be exhausted, leading to process termination and dropped connections.

Summary

Crow versions prior to 1.3.4 contain an uncontrolled recursion vulnerability in the crow::json::load() function. Remote unauthenticated attackers can exploit this by sending a request body with thousands of nested JSON objects, causing the worker thread stack to overflow and crash the server process. This results in denial of service by terminating the process and dropping all active connections.

Impact

The vulnerability allows remote unauthenticated attackers to cause a denial of service by crashing the server process. This disrupts availability by terminating the worker thread handling the request and dropping all connections.

What to do

Affected software

Description

AnalysisAI-generated, updated 10/24/2026, 11:50:39 UTC

Technical details

References

Related threats