The vulnerability in cJSON up to version 1.7.19 is due to inefficient algorithmic complexity in the cJSON_Compare() function. When comparing JSON objects, the function recursively processes each shared subtree twice, once in each direction, without limiting recursion depth. This behavior causes the running time to grow exponentially with the nesting depth of the JSON document. As a result, even small JSON documents with deep nesting (around 40 levels) can cause the comparison to take hours of CPU time. An attacker can exploit this by providing crafted JSON data that is structurally equal to a reference document, triggering a denial-of-service condition through excessive CPU consumption.

Applications using vulnerable versions of cJSON that call cJSON_Compare() on attacker-controlled JSON data may experience denial-of-service due to excessive CPU usage. The exponential time complexity can severely degrade performance, potentially making the application unresponsive or causing resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid calling cJSON_Compare() on untrusted or attacker-influenced JSON data with deep nesting. Consider implementing application-level limits on JSON nesting depth or using alternative JSON comparison methods that do not exhibit this inefficiency.