CVE-2013-6401: Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, wh...

Security readout for executives and security teams

This is a denial-of-service risk in Jansson, a JSON parsing library. A malicious JSON document could make affected software spend excessive CPU handling predictable hash collisions. The bundle does not show data theft or code execution, and it does not show active exploitation. Exposure is most likely in applications, APIs, or services that parse untrusted JSON using Jansson versions possibly 2.4 or earlier. The bundle does not identify specific downstream products or package versions beyond Jansson. Treat this as a service-availability issue, not a confirmed breach vector. Prioritize remediation where old Jansson is reachable through public or partner-facing JSON APIs, especially on business-critical services. Mitigation focus: Inventory systems and applications that include or link against Jansson.; Use vendor-supported fixed Jansson packages; check Red Hat, openSUSE, or upstream guidance.; Prioritize internet-facing JSON endpoints that accept unauthenticated or high-volume requests..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.