Bug 2561515 (CVE-2026-116620) - CVE-2026-116620 rapidjson: rapidjson: Denial of Service via out-of-bounds read in regex parser
Summary: CVE-2026-116620 rapidjson: rapidjson: Denial of Service via out-of-bounds rea...
Keywords:
Status: NEW
Alias: CVE-2026-116620
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2562866 2562867 2562869 2562870 2562872 2562875 2562878 2562879 2562880 2562881 2562882 2562884 2562885 2562887 2562888 2562889 2562890 2562891 2562892 2562893 2562894 2562895 2562897 2562898 2562899 2562900 2562901 2562902 2562903 2562904 2562905 2562906 2562907
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-27 01:12 UTC by OSIDB Bzimport
Modified: 2026-10-28 13:53 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-27 01:12:25 UTC 
A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Note You need to log in before you can comment on or make changes to this bug.