CVE-2021-31875

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-31875

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31875.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-31875

Published

2021-04-29T02:15:08.043Z

Modified

2026-07-08T22:15:02.494763Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

In mjsjson.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjsjson_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t very much of an opportunity to exploit this reliably for an information leak, so there isn’t any real security impact."

References

Affected packages

Git / github.com/418sec/mjs

Affected ranges

Type

GIT

Repo

https://github.com/418sec/mjs

Events

Introduced

30aa0f84dbb274afdd95006ed18431e131654cac

Last affected

30aa0f84dbb274afdd95006ed18431e131654cac

Database specific

{
    "cpe": "cpe:2.3:a:cesanta:mongooseos_mjs:1.26:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.26"
        },
        {
            "last_affected": "1.26"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*

1.26

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31875.json"

Git / github.com/cesanta/mjs

Affected ranges

Type

GIT

Repo

https://github.com/cesanta/mjs

Events

Introduced

30aa0f84dbb274afdd95006ed18431e131654cac

Last affected

30aa0f84dbb274afdd95006ed18431e131654cac

Fixed

30aa0f84dbb274afdd95006ed18431e131654cac

Database specific

{
    "cpe": "cpe:2.3:a:cesanta:mongooseos_mjs:1.26:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.26"
        },
        {
            "last_affected": "1.26"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.26

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/cesanta/mjs/commit/30aa0f84dbb274afdd95006ed18431e131654cac",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "234456157171672009667012020005863685987",
                "146345927612699616111074413700893716313",
                "108905283697329949653992095110269968398",
                "40928701320816293082107573540797344185",
                "16737667361413382403951905663352361970",
                "32490330477822729405061052842574627060",
                "164173215868758275743162668968896081187",
                "336220235712481336989938226589175284337",
                "320868728181603703685665517682974328720",
                "27893539343358266705685645107797522834"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2021-31875-6caf7cb9",
        "target": {
            "file": "common/cs_varint.c"
        }
    },
    {
        "source": "https://github.com/cesanta/mjs/commit/30aa0f84dbb274afdd95006ed18431e131654cac",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "291219462004385368167517558065082996591",
            "length": 389.0
        },
        "deprecated": false,
        "id": "CVE-2021-31875-7753ab29",
        "target": {
            "function": "cs_varint_decode",
            "file": "mjs.c"
        }
    },
    {
        "source": "https://github.com/cesanta/mjs/commit/30aa0f84dbb274afdd95006ed18431e131654cac",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "291219462004385368167517558065082996591",
            "length": 389.0
        },
        "deprecated": false,
        "id": "CVE-2021-31875-789e4ca9",
        "target": {
            "function": "cs_varint_decode",
            "file": "common/cs_varint.c"
        }
    },
    {
        "source": "https://github.com/cesanta/mjs/commit/30aa0f84dbb274afdd95006ed18431e131654cac",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "234456157171672009667012020005863685987",
                "146345927612699616111074413700893716313",
                "108905283697329949653992095110269968398",
                "40928701320816293082107573540797344185",
                "16737667361413382403951905663352361970",
                "32490330477822729405061052842574627060",
                "164173215868758275743162668968896081187",
                "336220235712481336989938226589175284337",
                "320868728181603703685665517682974328720",
                "27893539343358266705685645107797522834"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2021-31875-ebec0f7c",
        "target": {
            "file": "mjs.c"
        }
    }
]

vanir_signatures_modified

"2026-07-08T22:15:02Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31875.json"