Vulnerability in N/a

CVE-2026-29975

lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson_stream.c). The end-of-string detection logic incorrectly identifies escaped quote characters by only checking the immediately preceding character rather than counting consecutive backslashes, causing valid JSON strings ending with an escaped backslash (like "\\") to never terminate parsing. A remote attacker can send well-formed JSON to cause applications using lwjson_stream_parse() to hang indefinitely, resulting in denial of service.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.007 (53.2th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 53.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-29975: held from 0.004 to 0.007.

EPSS over last 30 days · oldest: 0.004 · newest: 0.007 · change: +0.003

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-29975?
CVE-2026-29975 is a high-severity vulnerability in N/a, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2026-05-08.
How severe is CVE-2026-29975?
High severity. CVSS v3 base score is 7.5 out of 10.