open-source-parsers.jsoncpp is vulnerable to Use After Free
72
High Risk
The Reader::parse(std::istream&) overload read the stream into a local std::string, then forwarded pointers into that buffer to parse(const char*, const char*), which stored them in begin_ / end_. After parse returned, the local string was destroyed while the reader could still hold those pointers. Calling getFormattedErrorMessages() afterward could read freed memory. The fix reads the stream into the member document_ so the buffer lifetime matches the reader, consistent with parse(const std::string&).
You are affected if you are using a version that falls within the vulnerable range.
open-source-parsers.jsoncpp is vulnerable to Use After Free in versions 0.0.1 - 1.9.6.
Upgrade the open-source-parsers.jsoncpp library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

SOC 2Compliant
ISO 27001Compliant