PT-2026-65815
CVE-2026-67217
·
Published
2026-07-25
·
Updated
2026-08-04
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
cJSON versions prior to 1.7.20
Description
The
apply patch() function in cJSON Utils.c performs RFC 6902 JSON Patch operations non-atomically. When a replace operation lacks a value member or a move operation has an unresolvable destination path, the target member is detached and deleted before the operation is fully validated. This results in the target document being mutated even when cJSONUtils ApplyPatches() or cJSONUtils ApplyPatchesCaseSensitive() returns a failure status. An attacker providing a malicious patch document can destroy addressable members of the target document, bypassing the expected all-or-nothing behavior used to reject invalid patches.Recommendations
Update to version 1.7.20 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾