Uncontrolled Recursion in JSON Parsing Causes Denial of Service

Crow before version 1.3.4 contains a critical uncontrolled recursion vulnerability in its JSON parsing functionality that enables remote denial-of-service attacks. When an attacker sends HTTP requests containing deeply nested JSON objects, the crow::json::load() function recursively processes each level without proper depth limits, exhausting the worker thread's stack memory. This causes the affected server process to crash, terminating all active connections and making the service unavailable. Any organization running vulnerable versions of Crow—a popular C++ web framework—faces immediate risk, particularly those exposing Crow-based APIs to untrusted networks or the internet.

While this vulnerability doesn't map to specific MITRE ATT&CK techniques in the traditional sense, Casky's extended reasoning capabilities would identify the attack pattern as a resource exhaustion variant related to Impact techniques. A practitioner using Casky would observe anomalous request patterns in their findings: repeated POST/PUT requests with progressively deeper JSON nesting, unusual memory consumption spikes in worker threads, and correlated service crashes following these requests. Casky's skills would help correlate these indicators with CWE-674 (uncontrolled recursion) and recommend immediate patching to versions 1.3.4 or later, along with input validation rules to reject excessively nested JSON at the application gateway level as a compensating control.