Thinking about this a little more, I was worried you might have been right about nested JSON objects, and that deeply-nested JSON objects in the JSON-RPC API could still cause the thread to die because

I thought that custom_json ops didn't use the C++ variant type, but just a JSON string. There is a bug in the JSON parser, but not an exploitable one in the way it is used. But I haven't looked at that

I haven't identified other good entry points for fuzzing yet; one of the things I'm building is tooling that will make it easier to do so and construct the harness automatically. There are also fuzzing

Pennsif, I wrote up an article on the security vulnerability patched in 0.20.7 and 0.20.8, which answers some of the questions people may have about why a change was needed:

Thanks for upgrading so promptly. I published my article describing the security vulnerability today:

As promised:

I'll have an article up about that in a couple days (I was the one who found the bug.)