Description

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-14T13:19:30.080Z",
  "pubdate": "2026-09-14T13:19:30.080Z",
  "executiveSummary": "A critical integer overflow vulnerability has been identified in the Gravity programming language, specifically within the json-parser component located in src/utils/gravity_json.c. This flaw affects versions up to 0.9.7 and exposes the application to remote exploitation.\nThe vulnerability originates from improper handling of integer operations during JSON parsing, which can lead to memory corruption or undefined behavior. If successfully exploited, this remote attack vector could allow unauthorized actors to manipulate application state, potentially leading to a denial-of-service condition or arbitrary code execution depending on the host environment's memory architecture.\nGiven that the exploit has been disclosed publicly, the risk of active exploitation is significant. Organizations utilizing Gravity 0.9.7 or earlier are advised to prioritize immediate remediation. The vulnerability is resolved in version 0.9.8 via patch 9b337c3eae5833c3956bed1fc01c21c14fd443f2, which corrects the arithmetic logic within the parser's utility functions.",
  "technicalDetails": "The vulnerability resides within the udp json-parser component of the Gravity engine, specifically within the logic implemented in src/utils/gravity_json.c. The root cause is an integer overflow condition triggered during the parsing of malformed or maliciously crafted JSON payloads.\nWhen the parser processes numeric or structural data within a JSON object, it performs arithmetic operations to allocate memory or calculate buffer offsets. If the input data is specifically structured to force these calculations to exceed the maximum value representable by the integer type used in the source code (e.g., wrap-around), an integer overflow occurs. This overflow typically results in an undersized memory allocation or an incorrect pointer offset calculation.\nThe attack flow initiates when a remote attacker submits a specially crafted JSON payload to a Gravity-enabled service. As the parser traverses the input, the overflow is triggered during the processing of the affected function. Because the parser does not perform sufficient validation or range checks on the values derived from the JSON input prior to arithmetic operations, the resulting overflow bypasses existing safety boundaries.\nIn terms of exploitation, the mismatch between the intended size and the actual allocated memory allows an attacker to cause an out-of-bounds write or memory corruption. If the overflow affects buffer size calculations, subsequent data copied into the buffer will exceed its capacity, overwriting adjacent memory regions. This behavior can be leveraged to corrupt sensitive data structures, hijack control flow if function pointers are adjacent in memory, or induce a crash resulting in a denial-of-service.\nThe vulnerability is accessible remotely, meaning an attacker does not require local access or specific authentication to trigger the flaw, provided the Gravity instance is configured to receive and parse JSON input from external sources. The exploitability is further heightened by the public disclosure of a working exploit, lowering the barrier for entry for threat actors. The patch identified by the hash 9b337c3eae5833c3956bed1fc01c21c14fd443f2 implements strict bounds checking and overflow detection mechanisms to ensure that integer operations remain within safe, defined limits before proceeding with memory allocation or pointer arithmetic."
}