#1704·jsoncpp

Denial-of-service from uncontrolled deep recursion in OurReader::readValue (exceed stackLimit)

Author: eglonnnnCreated Jul 4, 2026Updated Jul 4, 2026

Describe the bug A denial-of-service vulnerability in jsoncpp 1.9.6. When OurReader::readValue() parses a deeply nested JSON array, recursive calls between readValue() and readArray() exceed the default stackLimit (1000) and throw an uncaught Json::RuntimeError, causing std::terminate() and process exit.

The crash occurs at json_reader.cpp:1041:5 in Json::OurReader::readValue(), triggered by a crafted input containing approximately 1100 consecutive [ characters.

All complete vulnerability resources, including vulnerability description, fuzzer binary, PoC payload and reproduction steps, are stored in my research repository: https://github.com/eglonnnn/opensource-fuzz-vulnerability-research/tree/main/jsoncpp-deep-nested-array-recursion-dos

Source: open-source-parsers/jsoncpp