cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0c3f6c7c67 advisory.

    Update to version 1.7.19.

    https://github.com/DaveGamble/cJSON/blob/v1.7.19/CHANGELOG.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20340-1 advisory.

    - Update to version 1.7.19
      * Check for NULL in cJSON_DetachItemViaPointer.
      * Check overlap before calling strcpy in cJSON_SetValuestring.
      * Fix Max recursion depth for cJSON_Duplicate to prevent stack         exhaustion.
      * Allocate memory for the temporary buffer when paring numbers.
        This fixes CVE-2023-26819. (bsc#1241502)
      * Fix the incorrect check in decode_array_index_from_pointer.
        This fixes CVE-2025-57052. (bsc#1249112)
    - Remove not longer needed patch for NULL to deallocated pointers.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7973-1 advisory.

    It was discovered that cJSON incorrectly handled parsing large numbers. An attacker could possibly use     this issue to cause a denial of service. (CVE-2023-26819)

    It was discovered that cJSON may perform out-of-bounds read when processing specially crafted JSON files     using parse_object. An attacker could possibly use this issue to expose sensitive information or crash the     program. (CVE-2023-53154)

    It was discovered that cJSON incorrectly validated array indices in JSON pointers, which could result in     an out-of-bounds memory access. An attacker could possibly use this issue to cause a denial of service, or     execute arbitrary code. (CVE-2025-57052)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in
    cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via
    malformed JSON pointer strings containing alphanumeric characters. (CVE-2025-57052)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03520-1 advisory.

    - CVE-2023-26819: Allocate memory for the temporary buffer when paring numbers (bsc#1241502)
    - CVE-2025-57052: Fix the incorrect check in decode_array_index_from_pointer (bsc#1249112)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17613 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON     pointer strings (CVE-2025-57052)

    * python-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833)

    * puppet-agent: incomplete fix for CVE-2024-49761 (CVE-2025-10990)

    * Fail to upgrade to Satellite 6.16 when Satellite has more than 520 users (SAT-38406)

    * Ensure host key cleanup of /usr/share/foreman-proxy/.ssh/known_hosts on the Satellite (or Capsule)     server when first remote execution is using Ansible (SAT-38408)

    * Installer loads plugins from /opt/puppetlabs/puppet/cache/lib/, breaking PostgreSQL config updates and     thus upgrades from 6.15 to 6.16 (max_connections is not updated) (SAT-38410)

    * Second container push set manifest size fields to -1, which breaks bootc (SAT-38411)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17606 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * puppet-agent: incomplete fix for CVE-2024-49761 (CVE-2025-10990)
    * python-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833)
    * cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON     pointer strings (CVE-2025-57052)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17614 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * python-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833)
    * cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON     pointer strings (CVE-2025-57052)
    * puppet-agent: REXML ReDoS vulnerability (CVE-2024-49761)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4304 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4304-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     September 18, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : cjson     Version        : 1.7.14-1+deb11u3     CVE ID         : CVE-2025-57052


    It was discovered that cJSON, an ultralightweight JSON parser, performed     insufficient input sanitising, which could result in out-of-bounds     memory access.


    For Debian 11 bullseye, this problem has been fixed in version     1.7.14-1+deb11u3.

    We recommend that you upgrade your cjson packages.

    For the detailed security status of cjson please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cjson

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6001 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6001-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 14, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : cjson     CVE ID         : CVE-2025-57052

    It was discovered that cJSON, an ultralightweight JSON parser, performed     insufficient input sanitising, which could result in out-of-bounds     memory access.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 1.7.15-1+deb12u4.

    For the stable distribution (trixie), this problem has been fixed in     version 1.7.18-3.1+deb13u1.

    We recommend that you upgrade your cjson packages.

    For the detailed security status of cjson please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cjson

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in     cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via     malformed JSON pointer strings containing alphanumeric characters. (CVE-2025-57052)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
326357	Fedora 44 : cjson (2026-0c3f6c7c67)	Nessus	Fedora Local Security Checks	Local	critical
302091	openSUSE 16 Security Update : cJSON (openSUSE-SU-2026:20340-1)	Nessus	SuSE Local Security Checks	Local	critical
296748	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : cJSON vulnerabilities (USN-7973-1)	Nessus	Ubuntu Local Security Checks	Local	medium
435798	Alpine: multiple cjson packages: security update to 1.7.19-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
435798	Alpine: multiple cjson packages: security update to 1.7.19-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
270096	SUSE SLED15 / SLES15 Security Update : cJSON (SUSE-SU-2025:03520-1)	Nessus	SuSE Local Security Checks	Local	critical
269754	RHEL 8 / 9 : Satellite 6.16.5.4 Async Update (Important) (RHSA-2025:17613)	Nessus	Red Hat Local Security Checks	Local	critical
269753	RHEL 9 : Satellite 6.17.5 Async Update (Important) (RHSA-2025:17606)	Nessus	Red Hat Local Security Checks	Local	critical
269752	RHEL 8 : Satellite 6.15.5.5 Async Update (Important) (RHSA-2025:17614)	Nessus	Red Hat Local Security Checks	Local	high
265393	Debian dla-4304 : libcjson-dev - security update	Nessus	Debian Local Security Checks	Local	critical
264782	Debian dsa-6001 : libcjson-dev - security update	Nessus	Debian Local Security Checks	Local	critical
261534	Linux Distros Unpatched Vulnerability : CVE-2025-57052	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2025-57052

critical

Tenable Plugins

critical

critical

medium

critical

critical

critical

critical

critical

high

critical

critical

critical