p PatchFirst

CVE-2026-116620

CVE-2026-116620 · Tencent RapidJSON Regex stream.h Take out-of-bounds

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 6.9 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • rapidjson

    Versions
    • 1.0: Affected
    • 1.1.0: Affected

    No fix published

  • rapidjson Debian:12

    Versions
    • 1.1.0+dfsg2-7.1
    • 1.1.0+dfsg2-7.2
    • 1.1.0+dfsg2-7.3
    • 1.1.0+dfsg2-7.4
    • 1.1.0+dfsg2-7.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Debian:13

    Versions
    • 1.1.0+dfsg2-7.4
    • 1.1.0+dfsg2-7.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Debian:14

    Versions
    • 1.1.0+dfsg2-7.4
    • 1.1.0+dfsg2-7.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:Pro:16.04:LTS

    Versions
    • 0.12~git20141031-3
    • 0.12~git20141031-3ubuntu0.1~esm1
    • 0.12~git20141031-3ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:Pro:18.04:LTS

    Versions
    • 0.12~git20141031+dfsg-1
    • 1.1.0+dfsg2-3
    • 1.1.0+dfsg2-3ubuntu0.1~esm1
    • 1.1.0+dfsg2-3ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:Pro:20.04:LTS

    Versions
    • 1.1.0+dfsg2-5
    • 1.1.0+dfsg2-5ubuntu1
    • 1.1.0+dfsg2-5ubuntu1+esm1
    • 1.1.0+dfsg2-5ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:Pro:22.04:LTS

    Versions
    • 1.1.0+dfsg2-7
    • 1.1.0+dfsg2-7ubuntu0.1~esm1
    • 1.1.0+dfsg2-7ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:Pro:24.04:LTS

    Versions
    • 1.1.0+dfsg2-7.1
    • 1.1.0+dfsg2-7.2
    • 1.1.0+dfsg2-7.2ubuntu0.1~esm1
    • 1.1.0+dfsg2-7.2ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:26.10

    Versions
    • 1.1.0+dfsg2-7.6ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rapidjson Ubuntu:26.04:LTS

    Versions
    • 1.1.0+dfsg2-7.3ubuntu1
    • 1.1.0+dfsg2-7.6ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →