Is CVE-2026-116011 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116011?

CVE-2026-116011 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-116011

Description

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.