CVE-2025-57052
Fixed in a distro release EPSS <1%CVSS 9.8
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
Products: davegamble cjson
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.19 | cjson | 1.7.19-r0 |
| Alpine 3.20 | cjson | 1.7.19-r0 |
| Alpine 3.21 | cjson | 1.7.19-r0 |
| Alpine 3.22 | cjson | 1.7.19-r0 |
| Alpine 3.23 | cjson | 1.7.19-r0 |
| Alpine 3.24 | cjson | 1.7.19-r0 |
| Debian 11 | cjson | 1.7.14-1+deb11u3 |
| Debian 12 | cjson | 1.7.15-1+deb12u4 |
| Debian 13 | cjson | 1.7.18-3.1+deb13u1 |
| Debian 14 | cjson | 1.7.19-1 |
| Red Hat satellite 6.15 | cjson | 0:1.7.18-2.el8sat |
| Red Hat satellite 6.15 | cjson-debuginfo | 0:1.7.18-2.el8sat |
| Red Hat satellite 6.15 | cjson-debugsource | 0:1.7.18-2.el8sat |
| Red Hat satellite 6.15 | puppet-agent | 0:7.34.0-4.el8sat |
| Red Hat satellite 6.15 | python-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite 6.15 | python3.11-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite 6.16 | cjson | 0:1.7.18-2.el8sat |
| Red Hat satellite 6.16 | cjson | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.16 | cjson-debuginfo | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.16 | cjson-debuginfo | 0:1.7.18-2.el8sat |
| Red Hat satellite 6.16 | cjson-debugsource | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.16 | cjson-debugsource | 0:1.7.18-2.el8sat |
| Red Hat satellite 6.16 | puppet-agent | 0:8.8.1-3.el9sat |
| Red Hat satellite 6.16 | puppet-agent | 0:8.8.1-3.el8sat |
| Red Hat satellite 6.16 | python-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite 6.16 | python-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite 6.16 | python3.11-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite 6.16 | python3.11-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite 6.17 | cjson | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.17 | cjson-debuginfo | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.17 | cjson-debugsource | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.17 | puppet-agent | 0:8.8.1-3.el9sat |
| Red Hat satellite 6.17 | python-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite 6.17 | python3.11-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite capsule 6.15 | cjson | 0:1.7.18-2.el8sat |
| Red Hat satellite capsule 6.15 | cjson-debuginfo | 0:1.7.18-2.el8sat |
| Red Hat satellite capsule 6.15 | cjson-debugsource | 0:1.7.18-2.el8sat |
| Red Hat satellite capsule 6.15 | puppet-agent | 0:7.34.0-4.el8sat |
| Red Hat satellite capsule 6.15 | python-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite capsule 6.16 | cjson | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.16 | cjson | 0:1.7.18-2.el8sat |
| Red Hat satellite capsule 6.16 | cjson-debuginfo | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.16 | cjson-debuginfo | 0:1.7.18-2.el8sat |
| Red Hat satellite capsule 6.16 | cjson-debugsource | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.16 | cjson-debugsource | 0:1.7.18-2.el8sat |
| Red Hat satellite capsule 6.16 | puppet-agent | 0:8.8.1-3.el8sat |
| Red Hat satellite capsule 6.16 | puppet-agent | 0:8.8.1-3.el9sat |
| Red Hat satellite capsule 6.16 | python-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite capsule 6.16 | python-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite capsule 6.16 | python3.11-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite capsule 6.17 | cjson | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.17 | cjson-debuginfo | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.17 | cjson-debugsource | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.17 | puppet-agent | 0:8.8.1-3.el9sat |
| Red Hat satellite capsule 6.17 | python-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-django | 0:4.2.24-0.1.el9pc |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | cJSON | 1.7.19-150700.3.3.1 |
| Ubuntu 22.04 LTS | cjson | 1.7.15-1ubuntu0.1 |
| Ubuntu 25.10 | cjson | 1.7.18-3.1ubuntu0.1 |
| Ubuntu Pro 20.04 LTS | cjson | 1.7.10-1.1ubuntu0.1~esm1 |
| Ubuntu Pro 24.04 LTS | cjson | 1.7.17-1ubuntu0.1~esm3 |
| openSUSE Leap 16.0 | cJSON | 1.7.19-160000.1.1 |
| openSUSE Tumbleweed | cJSON | 1.7.19-1.1 |