CVE-2026-67215

Name of the Vulnerable Software and Affected Versions cJSON versions prior to 1.7.20

Description The issue involves uncontrolled recursion in the cJSONUtils ApplyPatches() and cJSONUtils ApplyPatchesCaseSensitive() functions. When an untrusted RFC 6902 JSON Patch is applied, an attacker can use add and copy operations to create duplicated subtrees that increase the document depth beyond the parser's nesting limit. Because the cJSON Delete() function recurses without a depth bound and the CJSON CIRCULAR LIMIT guard in cJSON Duplicate() is set to 10,000 (which exceeds the 1,000-level nesting limit), the process can suffer from stack exhaustion. This allows a remote attacker to crash the process, resulting in a denial of service.

Recommendations Update to version 1.7.20 or later. As a temporary mitigation, restrict the use of the cJSONUtils ApplyPatches() and cJSONUtils ApplyPatchesCaseSensitive() functions when processing untrusted JSON Patch documents.