{"id":"AZL-94407","summary":"CVE-2026-67216 affecting package apparmor 3.1.7-1","details":"cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.","modified":"2026-09-01T05:28:09Z","published":"2026-07-29T14:16:35Z","upstream":["CVE-2026-67216"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67216"}],"affected":[{"package":{"name":"apparmor","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/apparmor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.7-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-94407.json"}}],"schema_version":"1.9.0"}