{"id":"CVE-2026-90715","summary":"marcobambini Gravity udp json-parser gravity_json.c integer overflow","details":"A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2. Upgrading the affected component is recommended.","modified":"2026-09-16T08:09:43.817213Z","published":"2026-09-14T12:30:09.951Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-189","CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90715.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0.9.1"},{"last_affected":"0.9.1"},{"introduced":"0.9.2"},{"last_affected":"0.9.2"},{"introduced":"0.9.3"},{"last_affected":"0.9.3"},{"introduced":"0.9.4"},{"last_affected":"0.9.4"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://github.com/marcobambini/gravity/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90715.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90715"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90715"},{"type":"ADVISORY","url":"https://vuldb.com/submit/919189"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403269"},{"type":"REPORT","url":"https://github.com/marcobambini/gravity/issues/447"},{"type":"REPORT","url":"https://vuldb.com/vuln/403269/cti"},{"type":"FIX","url":"https://github.com/marcobambini/gravity/pull/451"},{"type":"FIX","url":"https://github.com/marcobambini/gravity/releases/tag/0.9.8"},{"type":"FIX","url":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/marcobambini/gravity","events":[{"introduced":"9fccc47b8bd43ec1ac8a2868b938e2d64c2806aa"},{"fixed":"40a26f2c81051af00544e7a667ff5b1084b9937c"}],"database_specific":{"extracted_events":[{"introduced":"0.9.0"},{"last_affected":"0.9.0"},{"introduced":"0.9.5"},{"last_affected":"0.9.5"},{"introduced":"0.9.6"},{"last_affected":"0.9.6"},{"introduced":"0.9.7"},{"last_affected":"0.9.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/sthagen/marcobambini-gravity","events":[{"introduced":"0"},{"fixed":"9b337c3eae5833c3956bed1fc01c21c14fd443f2"}],"database_specific":{"source":"REFERENCES"}}],"versions":["0.9.0","0.9.5","0.9.6","0.9.7","v0.9.5","0.7.8","0.7.7","0.7.6","0.7.5","0.7.4","0.7.0","0.6.9","0.6.7","0.6.6","0.6.5","0.6.4","0.6.3","0.6.1","0.6.0","0.5.9","0.5.8","0.5.6","0.5.5","0.5.4","0.5.1","0.5.0","0.4.9","0.4.8","0.4.7","0.4.5","0.4.4","0.4.3","0.4.2","0.4.1","0.4.0","0.3.8","0.3.7","0.3.6","0.3.5","0.3.0","0.2.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90715.json","vanir_signatures_modified":"2026-09-16T08:09:43Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"232200379404445366365036093969002427147","length":12363},"id":"CVE-2026-90715-122019dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/utils/gravity_json.c","function":"json_parse_ex"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["26024780977641638348574132098132970872","260844202045014263856956935377161678601","300823103471968379120022696207420363584"]},"id":"CVE-2026-90715-1986bf57","signature_type":"Line","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/utils/gravity_json.h"}},{"deprecated":false,"digest":{"function_hash":"280251523899474841246980219471860752856","length":512},"id":"CVE-2026-90715-30b6a0fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_buildpath"}},{"target":{"file":"src/utils/gravity_utils.c","function":"file_size"},"deprecated":false,"digest":{"function_hash":"175537896541162334888258530959801595990","length":350},"id":"CVE-2026-90715-3f8305fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c"},{"source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/utils/gravity_json.c"},"deprecated":false,"digest":{"line_hashes":["55892825186232913940297716845038020019","62552191506194730925217264240326149201","206867632584928810467891465941406731946","199296733975424838780751954136441734565","254041168489817386337136450409028383288","226119223955728670483856833969229202442","283531147810570819363685977083317003073","297674591424661520175631287873532996676","59351655657689352259326931835898935296","198850574567507344889956286657440677709","43820989809423365602986665707782721444","333053095484237793277846892264042089116","24573199715883699655076502476775953957","238976751286574114322985650447923072092","230700890109573394187024479106695983604","12626878027326228661927200480927750621","297174895791954990736312548567231229155","127244610020960159663139378842308001422","97370015863764898093369150077617193861","154190552253092280130291321232855442442","113524320659024744932795714841526999929","174368872456107073156949017426649303121","268522901857870817026393471972548062785","173274423157752955822210048033798246705","165616279679916301891811515839534050642","85315151951555543941759157729317577922","247769806382558406050032537813383549039","245178942849593251631984448723459968029","7211574166004230399621160334157072374","200972001851849836447313564865030703239","136630715194097056876083571868622446274","90486356244964638103312258238636010155","126801801320087959567622973650350329946","146926604129103191187292452293766200472","321731540757589718176912373950737549313","144750055792911738293000894879826691792","183064395409210398648220737178902366811","146571279115049350987060440809497191074","7137988671695777274793233156649088886","128982921761728795345327139890497432069","302912295921743117905204576539684502677","159990436404323654935265324301782601101","271490182198287648451448080731980143204","76318575503156263163499697074791335835","250532382376627658717277368713010269631","81558316154652019083337278284465555882","80528558335523852886811723047947950743","209340005783408719228722317315119492441","37096150076181999812715277108235426577","13867399101420555287175660330451477578","57537240610017428659671530890464526635"],"threshold":0.9},"id":"CVE-2026-90715-58337b4a","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["96651144436907160232074504838707307494","213230403875323693952521923652550117896","324125323960775487364419528686619175142","304731589433403457228151585164611957017"],"threshold":0.9},"id":"CVE-2026-90715-5a7d172e","signature_type":"Line","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/optionals/gravity_opt_file.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/shared/gravity_hash.c","function":"murmur3_32"},"deprecated":false,"digest":{"function_hash":"248731748528432841804395213972952232917","length":965},"id":"CVE-2026-90715-5fa7ccd1","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"21043015588810320897173356749066040767","length":736},"id":"CVE-2026-90715-64f51aa0","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"directory_read"}},{"digest":{"line_hashes":["222311800301159257551802957815531412578","227891431396206675631259796725117238812","239800484188899712317325038789509182269","184876545951272017641577791387436802943"],"threshold":0.9},"id":"CVE-2026-90715-7b57a6de","signature_type":"Line","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/cli/gravity.c"},"deprecated":false},{"digest":{"function_hash":"292201698311220064713275658324930317299","length":1657},"id":"CVE-2026-90715-8bd653ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/cli/gravity.c","function":"unittest_scan"},"deprecated":false},{"digest":{"function_hash":"273867842814167925731682929639642268846","length":339},"id":"CVE-2026-90715-99a7989a","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"is_directory"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"311722921221243564247507039258533545568","length":703},"id":"CVE-2026-90715-a7a780c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_read"}},{"deprecated":false,"digest":{"function_hash":"261129316849645513005458879864720704733","length":203},"id":"CVE-2026-90715-adb71db4","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_exists"}},{"digest":{"function_hash":"276554022861609927978807137165877858137","length":1591},"id":"CVE-2026-90715-b0d164fa","signature_type":"Function","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/runtime/gravity_vm.c","function":"gravity_vm_loadbuffer"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["171998522860799375329246083647297209069","202153836528375942826433514885113961422","49878170761193188891388360529417819454","41926036136238511553942967829525741728","186045587560834578138195199927629034997","331328434784006443528958675221319691820","96037272885285757275135768837691385498","74588932158989973984253638429125484683","9399635291382188694602848313726138654","287771819397513540801419301433258971687","308748575615950643470257055172674447810","81465575170926915188641506222405558807","32820429838223713709179410200939768144","160243854344577656418112476506045626539","30426429818791017290168596616054935164","338175142067738915091398713968528828192","79935986783588381145685434618977303713","206904988105558854209857039633328595961","150440060494602048113537811518148683060","50443550379712345800076736803138228044","268819806055924855904917929216125465","228552983236564788403058812132868542988","176878767200479338489901931820437686146","15159265763611550055316072406475918614","41433357737696350270533108331073017658","206401132703047742805718938859619776421","59832021658175235106953661090443940385","213810214108872669477168493498999140931","270467247810365354585805736930915789214","6290858756573692439742392728040033412","121839518022835460300587411390591683490","227908484603291776347802831733789446961","50310947663384982863885536925269563791","269544564613188023770437259094771039290","263199967309411238294028000887784428742","227410573654187210865998653840960011563","238264449871172835442701582923241534262","269544564613188023770437259094771039290","263199967309411238294028000887784428742","227410573654187210865998653840960011563"]},"id":"CVE-2026-90715-baf91a61","signature_type":"Line","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c"}},{"digest":{"function_hash":"281681127129311348374576764050549196354","length":1081},"id":"CVE-2026-90715-c67bb49c","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/optionals/gravity_opt_file.c","function":"scan_directory"},"deprecated":false},{"target":{"file":"src/shared/gravity_hash.c"},"deprecated":false,"digest":{"line_hashes":["16097657950372424063305007697436018387","247926387353832273300188727109329465540","158206771817149844540637642501730342802","182456322976153144258859614746250032211","217283093963858352796151779353445829795","313334659522679043914331839104409216944"],"threshold":0.9},"id":"CVE-2026-90715-cc011d12","signature_type":"Line","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2"},{"id":"CVE-2026-90715-cda51e68","signature_type":"Function","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/utils/gravity_json.c","function":"new_value"},"deprecated":false,"digest":{"function_hash":"104205694610765078440195808963915352138","length":1637}},{"id":"CVE-2026-90715-dd85f387","signature_type":"Line","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/runtime/gravity_vm.c"},"deprecated":false,"digest":{"line_hashes":["340161048533349102914087807804839375316","72873538009311109627339426333430145696","99135888413257966937334747893697447955","134084983354428998460073680349100041728","159586743362532861130470524098379177253","74943574752321039966595534101731726931","251768748289236295781685899839760324282","271083593337661949427234726209174618982","210474806979786096555268083690897085720","328422654460974293740721542191578751879","235967592069422590557848669810756607883"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"112058358530405323953144945288920279378","length":199},"id":"CVE-2026-90715-eba4eba2","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"directory_create"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"function":"directory_init","file":"src/utils/gravity_utils.c"},"deprecated":false,"digest":{"function_hash":"200016442785796770236119168003037320735","length":289},"id":"CVE-2026-90715-f0d18cf1"},{"deprecated":false,"digest":{"function_hash":"157046498083475499583745470024774660993","length":157},"id":"CVE-2026-90715-fce92716","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_delete"}},{"signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"directory_read_extend"},"deprecated":false,"digest":{"function_hash":"221356346687101137042958937155764747993","length":798},"id":"CVE-2026-90715-feff1751","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}