Code: static JSON_INLINE size_t num_buckets(hashtable_t *hashtable)
{
    return primes[hashtable->num_buckets];
}

Vulnerability Type: DoS 
CWE ID: CWE-310
Summary: Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
Commit Message: CVE-2013-6401: Change hash function, randomize hashes

Thanks to Florian Weimer and Eric Sesterhenn for reporting, reviewing
and testing.