Ladybird JSON Parser UTF-8 Validation Denial of Service
Invalid UTF-8 input could crash Ladybird's JSON parser with SIGILL, causing a denial of service in applications processing untrusted JSON. Discovered by Websec co-founder Paulino Calderon.
CVSS Score
Severity
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | Advisory ID | PWN-2026-001 |
| Published | April 27, 2026 |
| Researcher | Paulino Calderon |
| Component | Ladybird JSON Parser |
| Issue type | Denial of Service (DoS) |
Executive Summary
Ladybird's JSON parser did not validate that input was valid UTF-8 before processing JSON tokens. A specially crafted document containing an invalid UTF-8 byte sequence could trigger an illegal-instruction exception (SIGILL) and terminate the parser process.
The issue affected applications that passed untrusted byte input to Ladybird's JSON parsing functionality without first validating its encoding.
Technical Details
Malformed UTF-8 sequences could reach the parser's token-processing logic instead of being rejected at the entry point. Tested cases included incomplete multibyte sequences, invalid continuation bytes, invalid start bytes, and malformed bytes in JSON member names. These cases could terminate the process rather than return a parsing error.
Impact
- Availability: a crafted JSON document could crash the process and interrupt service.
- Confidentiality: no impact was identified.
- Integrity: no impact was identified.
CVSS Rationale
The disclosure assigns a CVSS v3.1 base score of 5.5 (Medium). Exploitation requires supplying a malicious JSON document for an application or user to process, needs no privileges, has low complexity, and can cause complete loss of availability for the affected process.
Resolution
Ladybird corrected the unsafe byte-string conversion in pull request #9152, merged on April 28, 2026, so invalid encoding is returned as an error. Users should update to a build containing that change. Until an update can be deployed, applications should reject input that is not valid UTF-8 before passing it to the parser.
Disclosure Timeline
- April 27, 2026: PWN-2026-001 published.
- April 28, 2026: issue reported to the Ladybird project and upstream fix merged.
- April 30, 2026: researcher advisory updated to note the patched status.
Credit
Discovered and responsibly disclosed by Paulino Calderon, co-founder of Websec.
Affected Products
Ladybird JSON Parser
- • All versions tested before the fix
Pull request #9152 (April 28, 2026)
Remediation
Update to a Ladybird build containing the invalid-UTF-8 handling fix from pull request #9152. Until updating, reject input that is not valid UTF-8 before passing untrusted data to the JSON parser.