ECHO-23c9-2f44-73c2
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-23c9-2f44-73c2.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-23c9-2f44-73c2
- Upstream
- Withdrawn
- 2026-09-29T11:15:04Z
- Published
- 2026-07-28T16:05:42Z
- Modified
- 2026-09-29T11:45:37Z
- Summary
- Integer overflow of the escape_characters counter in print_string_ptr() (cJSON.c). The counter is a size_t and the wrap needs ~858,993,460 control characters, i.e. a 32-bit size_t; the CVE text itself limits it to 32-bit platforms. Echo builds cjson only for amd64 and arm64, where size_t is 64-bit and the overflow cannot occur. There is no upstream fix to carry. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-16554 - https://cert.pl/en/posts/2026/07/CVE-2026-16554 details: | Same reasoning as libssh2 CVE-2026-58050: 32-bit-only arithmetic overflow, Echo ships 64-bit builds only. Re-evaluate if a 32-bit architecture is ever added to this spec.
- Details
- References