cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03520-1 advisory.

    - CVE-2023-26819: Allocate memory for the temporary buffer when paring numbers (bsc#1241502)
    - CVE-2025-57052: Fix the incorrect check in decode_array_index_from_pointer (bsc#1249112)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17613 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON     pointer strings (CVE-2025-57052)

    * python-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833)

    * puppet-agent: incomplete fix for CVE-2024-49761 (CVE-2025-10990)

    * Fail to upgrade to Satellite 6.16 when Satellite has more than 520 users (SAT-38406)

    * Ensure host key cleanup of /usr/share/foreman-proxy/.ssh/known_hosts on the Satellite (or Capsule)     server when first remote execution is using Ansible (SAT-38408)

    * Installer loads plugins from /opt/puppetlabs/puppet/cache/lib/, breaking PostgreSQL config updates and     thus upgrades from 6.15 to 6.16 (max_connections is not updated) (SAT-38410)

    * Second container push set manifest size fields to -1, which breaks bootc (SAT-38411)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17606 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * puppet-agent: incomplete fix for CVE-2024-49761 (CVE-2025-10990)
    * python-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833)
    * cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON     pointer strings (CVE-2025-57052)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17614 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * python-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833)
    * cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON     pointer strings (CVE-2025-57052)
    * puppet-agent: REXML ReDoS vulnerability (CVE-2024-49761)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4304 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4304-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     September 18, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : cjson     Version        : 1.7.14-1+deb11u3     CVE ID         : CVE-2025-57052


    It was discovered that cJSON, an ultralightweight JSON parser, performed     insufficient input sanitising, which could result in out-of-bounds     memory access.


    For Debian 11 bullseye, this problem has been fixed in version     1.7.14-1+deb11u3.

    We recommend that you upgrade your cjson packages.

    For the detailed security status of cjson please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cjson

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6001 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6001-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 14, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : cjson     CVE ID         : CVE-2025-57052

    It was discovered that cJSON, an ultralightweight JSON parser, performed     insufficient input sanitising, which could result in out-of-bounds     memory access.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 1.7.15-1+deb12u4.

    For the stable distribution (trixie), this problem has been fixed in     version 1.7.18-3.1+deb13u1.

    We recommend that you upgrade your cjson packages.

    For the detailed security status of cjson please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cjson

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in     cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via     malformed JSON pointer strings containing alphanumeric characters. (CVE-2025-57052)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
270096	SUSE SLED15 / SLES15 Security Update : cJSON (SUSE-SU-2025:03520-1)	Nessus	SuSE Local Security Checks	critical
269754	RHEL 8 / 9 : Satellite 6.16.5.4 Async Update (Important) (RHSA-2025:17613)	Nessus	Red Hat Local Security Checks	critical
269753	RHEL 9 : Satellite 6.17.5 Async Update (Important) (RHSA-2025:17606)	Nessus	Red Hat Local Security Checks	critical
269752	RHEL 8 : Satellite 6.15.5.5 Async Update (Important) (RHSA-2025:17614)	Nessus	Red Hat Local Security Checks	high
265393	Debian dla-4304 : libcjson-dev - security update	Nessus	Debian Local Security Checks	critical
264782	Debian dsa-6001 : libcjson-dev - security update	Nessus	Debian Local Security Checks	critical
261534	Linux Distros Unpatched Vulnerability : CVE-2025-57052	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-57052

critical

Tenable Plugins

critical

critical

critical

high

critical

critical

critical