CVE-2026-90714

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90714
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90714.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90714
Published
2026-09-14T12:15:10Z
Modified
2026-09-17T08:06:08Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
marcobambini Gravity JSON parser gravity_json.c memory corruption
Details

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90714.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.9.1"
                },
                {
                    "last_affected": "0.9.1"
                },
                {
                    "introduced": "0.9.2"
                },
                {
                    "last_affected": "0.9.2"
                },
                {
                    "introduced": "0.9.3"
                },
                {
                    "last_affected": "0.9.3"
                },
                {
                    "introduced": "0.9.4"
                },
                {
                    "last_affected": "0.9.4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/marcobambini/gravity

Affected ranges

Type
GIT
Repo
https://github.com/marcobambini/gravity
Events
Introduced
9fccc47b8bd43ec1ac8a2868b938e2d64c2806aa
Fixed
40a26f2c81051af00544e7a667ff5b1084b9937c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.9.0"
        },
        {
            "last_affected": "0.9.0"
        },
        {
            "introduced": "0.9.5"
        },
        {
            "last_affected": "0.9.5"
        },
        {
            "introduced": "0.9.6"
        },
        {
            "last_affected": "0.9.6"
        },
        {
            "introduced": "0.9.7"
        },
        {
            "last_affected": "0.9.7"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/sthagen/marcobambini-gravity
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9b337c3eae5833c3956bed1fc01c21c14fd443f2
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

0.*
0.2.8
0.3.0
0.3.5
0.3.6
0.3.7
0.3.8
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.4
0.5.5
0.5.6
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.9
0.7.0
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.9.0
0.9.5
0.9.6
0.9.7
v0.*
v0.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90714.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "232200379404445366365036093969002427147",
            "length": 12363
        },
        "id": "CVE-2026-90714-122019dd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2",
        "target": {
            "file": "src/utils/gravity_json.c",
            "function": "json_parse_ex"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "26024780977641638348574132098132970872",
                "260844202045014263856956935377161678601",
                "300823103471968379120022696207420363584"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90714-1986bf57",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2",
        "target": {
            "file": "src/utils/gravity_json.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "280251523899474841246980219471860752856",
            "length": 512
        },
        "id": "CVE-2026-90714-30b6a0fc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "file_buildpath"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "175537896541162334888258530959801595990",
            "length": 350
        },
        "id": "CVE-2026-90714-3f8305fd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "file_size"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "55892825186232913940297716845038020019",
                "62552191506194730925217264240326149201",
                "206867632584928810467891465941406731946",
                "199296733975424838780751954136441734565",
                "254041168489817386337136450409028383288",
                "226119223955728670483856833969229202442",
                "283531147810570819363685977083317003073",
                "297674591424661520175631287873532996676",
                "59351655657689352259326931835898935296",
                "198850574567507344889956286657440677709",
                "43820989809423365602986665707782721444",
                "333053095484237793277846892264042089116",
                "24573199715883699655076502476775953957",
                "238976751286574114322985650447923072092",
                "230700890109573394187024479106695983604",
                "12626878027326228661927200480927750621",
                "297174895791954990736312548567231229155",
                "127244610020960159663139378842308001422",
                "97370015863764898093369150077617193861",
                "154190552253092280130291321232855442442",
                "113524320659024744932795714841526999929",
                "174368872456107073156949017426649303121",
                "268522901857870817026393471972548062785",
                "173274423157752955822210048033798246705",
                "165616279679916301891811515839534050642",
                "85315151951555543941759157729317577922",
                "247769806382558406050032537813383549039",
                "245178942849593251631984448723459968029",
                "7211574166004230399621160334157072374",
                "200972001851849836447313564865030703239",
                "136630715194097056876083571868622446274",
                "90486356244964638103312258238636010155",
                "126801801320087959567622973650350329946",
                "146926604129103191187292452293766200472",
                "321731540757589718176912373950737549313",
                "144750055792911738293000894879826691792",
                "183064395409210398648220737178902366811",
                "146571279115049350987060440809497191074",
                "7137988671695777274793233156649088886",
                "128982921761728795345327139890497432069",
                "302912295921743117905204576539684502677",
                "159990436404323654935265324301782601101",
                "271490182198287648451448080731980143204",
                "76318575503156263163499697074791335835",
                "250532382376627658717277368713010269631",
                "81558316154652019083337278284465555882",
                "80528558335523852886811723047947950743",
                "209340005783408719228722317315119492441",
                "37096150076181999812715277108235426577",
                "13867399101420555287175660330451477578",
                "57537240610017428659671530890464526635"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90714-58337b4a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2",
        "target": {
            "file": "src/utils/gravity_json.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "96651144436907160232074504838707307494",
                "213230403875323693952521923652550117896",
                "324125323960775487364419528686619175142",
                "304731589433403457228151585164611957017"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90714-5a7d172e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/optionals/gravity_opt_file.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248731748528432841804395213972952232917",
            "length": 965
        },
        "id": "CVE-2026-90714-5fa7ccd1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2",
        "target": {
            "file": "src/shared/gravity_hash.c",
            "function": "murmur3_32"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "21043015588810320897173356749066040767",
            "length": 736
        },
        "id": "CVE-2026-90714-64f51aa0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "directory_read"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "222311800301159257551802957815531412578",
                "227891431396206675631259796725117238812",
                "239800484188899712317325038789509182269",
                "184876545951272017641577791387436802943"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90714-7b57a6de",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/cli/gravity.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "292201698311220064713275658324930317299",
            "length": 1657
        },
        "id": "CVE-2026-90714-8bd653ed",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/cli/gravity.c",
            "function": "unittest_scan"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "273867842814167925731682929639642268846",
            "length": 339
        },
        "id": "CVE-2026-90714-99a7989a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "is_directory"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "311722921221243564247507039258533545568",
            "length": 703
        },
        "id": "CVE-2026-90714-a7a780c1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "file_read"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "261129316849645513005458879864720704733",
            "length": 203
        },
        "id": "CVE-2026-90714-adb71db4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "file_exists"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "276554022861609927978807137165877858137",
            "length": 1591
        },
        "id": "CVE-2026-90714-b0d164fa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2",
        "target": {
            "file": "src/runtime/gravity_vm.c",
            "function": "gravity_vm_loadbuffer"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "171998522860799375329246083647297209069",
                "202153836528375942826433514885113961422",
                "49878170761193188891388360529417819454",
                "41926036136238511553942967829525741728",
                "186045587560834578138195199927629034997",
                "331328434784006443528958675221319691820",
                "96037272885285757275135768837691385498",
                "74588932158989973984253638429125484683",
                "9399635291382188694602848313726138654",
                "287771819397513540801419301433258971687",
                "308748575615950643470257055172674447810",
                "81465575170926915188641506222405558807",
                "32820429838223713709179410200939768144",
                "160243854344577656418112476506045626539",
                "30426429818791017290168596616054935164",
                "338175142067738915091398713968528828192",
                "79935986783588381145685434618977303713",
                "206904988105558854209857039633328595961",
                "150440060494602048113537811518148683060",
                "50443550379712345800076736803138228044",
                "268819806055924855904917929216125465",
                "228552983236564788403058812132868542988",
                "176878767200479338489901931820437686146",
                "15159265763611550055316072406475918614",
                "41433357737696350270533108331073017658",
                "206401132703047742805718938859619776421",
                "59832021658175235106953661090443940385",
                "213810214108872669477168493498999140931",
                "270467247810365354585805736930915789214",
                "6290858756573692439742392728040033412",
                "121839518022835460300587411390591683490",
                "227908484603291776347802831733789446961",
                "50310947663384982863885536925269563791",
                "269544564613188023770437259094771039290",
                "263199967309411238294028000887784428742",
                "227410573654187210865998653840960011563",
                "238264449871172835442701582923241534262",
                "269544564613188023770437259094771039290",
                "263199967309411238294028000887784428742",
                "227410573654187210865998653840960011563"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90714-baf91a61",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281681127129311348374576764050549196354",
            "length": 1081
        },
        "id": "CVE-2026-90714-c67bb49c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/optionals/gravity_opt_file.c",
            "function": "scan_directory"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "16097657950372424063305007697436018387",
                "247926387353832273300188727109329465540",
                "158206771817149844540637642501730342802",
                "182456322976153144258859614746250032211",
                "217283093963858352796151779353445829795",
                "313334659522679043914331839104409216944"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90714-cc011d12",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2",
        "target": {
            "file": "src/shared/gravity_hash.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "104205694610765078440195808963915352138",
            "length": 1637
        },
        "id": "CVE-2026-90714-cda51e68",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2",
        "target": {
            "file": "src/utils/gravity_json.c",
            "function": "new_value"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "340161048533349102914087807804839375316",
                "72873538009311109627339426333430145696",
                "99135888413257966937334747893697447955",
                "134084983354428998460073680349100041728",
                "159586743362532861130470524098379177253",
                "74943574752321039966595534101731726931",
                "251768748289236295781685899839760324282",
                "271083593337661949427234726209174618982",
                "210474806979786096555268083690897085720",
                "328422654460974293740721542191578751879",
                "235967592069422590557848669810756607883"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90714-dd85f387",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2",
        "target": {
            "file": "src/runtime/gravity_vm.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "112058358530405323953144945288920279378",
            "length": 199
        },
        "id": "CVE-2026-90714-eba4eba2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "directory_create"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "200016442785796770236119168003037320735",
            "length": 289
        },
        "id": "CVE-2026-90714-f0d18cf1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "directory_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "157046498083475499583745470024774660993",
            "length": 157
        },
        "id": "CVE-2026-90714-fce92716",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "file_delete"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "221356346687101137042958937155764747993",
            "length": 798
        },
        "id": "CVE-2026-90714-feff1751",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target": {
            "file": "src/utils/gravity_utils.c",
            "function": "directory_read_extend"
        }
    }
]
vanir_signatures_modified 
"2026-09-17T08:06:08Z"