Skip to main content
Medium April 27, 2026

Ladybird JSON Parser UTF-8 Validation Denial of Service

Invalid UTF-8 input could crash Ladybird's JSON parser with SIGILL, causing a denial of service in applications processing untrusted JSON. Discovered by Websec co-founder Paulino Calderon.

CVSS Score

5.5 / 10.0

Severity

Medium

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Advisory IDPWN-2026-001
PublishedApril 27, 2026
ResearcherPaulino Calderon
ComponentLadybird JSON Parser
Issue typeDenial of Service (DoS)

Executive Summary

Ladybird's JSON parser did not validate that input was valid UTF-8 before processing JSON tokens. A specially crafted document containing an invalid UTF-8 byte sequence could trigger an illegal-instruction exception (SIGILL) and terminate the parser process.

The issue affected applications that passed untrusted byte input to Ladybird's JSON parsing functionality without first validating its encoding.

Technical Details

Malformed UTF-8 sequences could reach the parser's token-processing logic instead of being rejected at the entry point. Tested cases included incomplete multibyte sequences, invalid continuation bytes, invalid start bytes, and malformed bytes in JSON member names. These cases could terminate the process rather than return a parsing error.

Impact

  • Availability: a crafted JSON document could crash the process and interrupt service.
  • Confidentiality: no impact was identified.
  • Integrity: no impact was identified.

CVSS Rationale

The disclosure assigns a CVSS v3.1 base score of 5.5 (Medium). Exploitation requires supplying a malicious JSON document for an application or user to process, needs no privileges, has low complexity, and can cause complete loss of availability for the affected process.

Resolution

Ladybird corrected the unsafe byte-string conversion in pull request #9152, merged on April 28, 2026, so invalid encoding is returned as an error. Users should update to a build containing that change. Until an update can be deployed, applications should reject input that is not valid UTF-8 before passing it to the parser.

Disclosure Timeline

  • April 27, 2026: PWN-2026-001 published.
  • April 28, 2026: issue reported to the Ladybird project and upstream fix merged.
  • April 30, 2026: researcher advisory updated to note the patched status.

Credit

Discovered and responsibly disclosed by Paulino Calderon, co-founder of Websec.

Affected Products

Ladybird JSON Parser

Affected Versions:
  • • All versions tested before the fix
Fixed In:

Pull request #9152 (April 28, 2026)

Remediation

Update to a Ladybird build containing the invalid-UTF-8 handling fix from pull request #9152. Until updating, reject input that is not valid UTF-8 before passing untrusted data to the JSON parser.

Share this advisory:

Related Security Advisories

Stay informed about other recent vulnerabilities and security advisories

Critical December 18, 2014

Command Execution and Backdoor in Zhone GPON-2520

This post will describe a backdoor account found in the Zhone GPON-2520 and will provide a PoC which can be used to disable the firewall filtration rules in order to allow access to services such as ssh, telnet and ftp.

Severity:
CVSS: 9.8
View advisory
High May 22, 2014

Huawei HG8245 / HG8247 WPA Generator

Huawei HG8245 & HG8247 ONT (firmware version V1R006C00S100) rely on a weak algorithm to calculate the WPA keys, keys can be predicted easily using the WiFi's MAC Address (BSSID).

Severity:
CVSS: 7.4
View advisory