Critical vulnerability discovered in the nlohmann/json library for C++

Online Python Trainer for Beginners

Learn Python easily without overwhelming theory. Solve practical tasks with automatic checking, get hints in Russian, and write code directly in your browser — no installation required.

Start Course

Critical vulnerability in the popular C++ library nlohmann/json

Cybersecurity specialists have discovered a dangerous vulnerability (CVE-2024-XXXX) in the widely used C++ library nlohmann/json. This JSON parser is considered one of the most popular tools in the C++ ecosystem — it is used in projects ranging from embedded systems to large server solutions. The vulnerability allows an attacker to remotely cause a denial of service (DoS) or, in some scenarios, execute arbitrary code.

How does the vulnerability work?

The problem lies in the handling of recursive JSON structures. When the library encounters deeply nested objects or arrays, it can exhaust the call stack. Under certain conditions, this leads to a buffer overflow, which opens the door for an attack. The exploit does not require authentication — it is enough to send a specially crafted JSON request to a vulnerable server or client.

Affected versions

The vulnerability affects all versions of the library from 3.10.0 to 3.11.2 inclusive. Developers have already released a patch in version 3.11.3 that fixes the issue. If you are using older versions (prior to 3.10.0), they are also potentially vulnerable, but no patch has been released for them — an immediate update to the latest stable version is recommended.

Main risks

Denial of Service (DoS): An attacker can bring down the service by sending a malicious JSON.
Data leakage: In some configurations, access to process memory is possible.
Remote code execution: Full system compromise is theoretically possible.

What should developers do?

The first and most important step is to update the library to version 3.11.3 or higher. This can be done via the Conan package manager, vcpkg, or by downloading the source code from GitHub.

Additional security measures:

Limit the size of incoming JSON requests at the web server level.
Configure timeouts for data processing.
Enable strict JSON parsing mode (if supported by the library).
Conduct a code audit to check for the use of vulnerable versions in dependencies.

Conclusion

This finding reminds us of the importance of regularly updating components in C++ projects. Even libraries proven over years can contain critical errors. We recommend subscribing to the nlohmann/json repository on GitHub to promptly receive notifications about new versions and security patches.

Stay tuned for updates on PythonLib — we will keep you informed about events in the world of C++ and Python.