Critical Vulnerability in jsoncons: Bad Parameters to --sanitizer-annotate-contiguous-container
Summary
OSV-2026-1361: Bad parameters to --sanitizer-annotate-contiguous-container in jsoncons::cbor::basic_cbor_parser. Affects jsoncons versions >= 29b374009c585c1ab49ad308b1ab3438a73acebf, < 2788b2285a309647d8833de25c182f543529c4d8. Fixed in 2788b2285a309647d8833de25c182f543529c4d8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsoncons is a C++ library designed for working with JSON and CBOR data formats. It provides a flexible and efficient way to serialize and deserialize data, making it a popular choice for developers needing to handle structured data in their applications. However, a recent vulnerability has been identified that affects the library's basic_cbor_parser functionality, potentially leading to application crashes under certain conditions.
Vulnerability Detail
The vulnerability arises from bad parameters passed to the --sanitizer-annotate-contiguous-container option in the jsoncons::cbor::basic_cbor_parser class. This issue was reported through OSS-Fuzz, indicating that improper handling of input data can lead to crashes, which may disrupt the functionality of applications relying on the jsoncons library. The crash state reveals that the parser fails to manage certain input scenarios, which can result in undefined behavior and potential data loss.
How To Fix
Minimum fixed version
2788b2285a309647d8833de25c182f543529c4d8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to ensure that parameters passed to the parser are within acceptable limits. This may involve checking the size and type of input data before processing it with the jsoncons parser. Additionally, consider using alternative libraries for JSON and CBOR processing until the update can be applied.
Conclusion
The jsoncons library has a critical vulnerability that can lead to application crashes due to bad parameters in its parsing functionality. It is essential for developers using this library to update to the latest version to ensure their applications remain stable and secure. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for jsoncons →
FAQ
jsoncons is a C++ library for working with JSON and CBOR data formats, providing serialization and deserialization capabilities.
The vulnerability involves bad parameters being passed to a function in the jsoncons library, which can lead to application crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, a patched version of jsoncons is available. Users should update to version 2788b2285a309647d8833de25c182f543529c4d8 or later.
Implement input validation as a temporary workaround to mitigate the risk until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for jsoncons.
