PT-2026-65813 · Cjson · Cjson
CVE-2026-67215
·
Published
2026-07-25
·
Updated
2026-08-04
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
cJSON versions prior to 1.7.20
Description
The issue involves uncontrolled recursion in the
cJSONUtils ApplyPatches() and cJSONUtils ApplyPatchesCaseSensitive() functions. When an untrusted RFC 6902 JSON Patch is applied, an attacker can use add and copy operations to create duplicated subtrees that increase the document depth beyond the parser's nesting limit. Because the cJSON Delete() function recurses without a depth bound and the CJSON CIRCULAR LIMIT guard in cJSON Duplicate() is set to 10,000 (which exceeds the 1,000-level nesting limit), the process can suffer from stack exhaustion. This allows a remote attacker to crash the process, resulting in a denial of service.Recommendations
Update to version 1.7.20 or later.
As a temporary mitigation, restrict the use of the
cJSONUtils ApplyPatches() and cJSONUtils ApplyPatchesCaseSensitive() functions when processing untrusted JSON Patch documents.Exploit
Fix
DoS
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cjson