CVE-2026-67215

Received Received - Intake

Stack Overflow in cJSON JSON Patch Processing

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: VulnCheck

Description

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-67215

Affected Vendors & Products

Vendor	Product	Version / Range
daniel_j_fischer	cjson	From 1.0.0 (inc) to 1.7.19 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

cJSON through 1.7.19 has a vulnerability where applying an untrusted RFC 6902 JSON Patch via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() causes uncontrolled recursion leading to stack exhaustion. Attackers can craft patches with add and copy operations to duplicate subtrees, amplifying document depth beyond safe limits. This triggers infinite recursion in cJSON_Delete() without depth checks, crashing the process and causing denial of service.

Detection Guidance

This vulnerability is specific to applications using cJSON library versions up to 1.7.19. To detect it, check if your system or application uses cJSON by searching for the library in installed packages or application dependencies. No direct detection commands are provided in the context.

Impact Analysis

If you use cJSON to process untrusted JSON Patch documents, an attacker could exploit this flaw to crash your application or service, resulting in denial of service. This could disrupt operations, cause downtime, or require manual intervention to restart affected systems.

Mitigation Strategies

Immediately update cJSON to the latest version that fixes the uncontrolled recursion issue. If updating is not possible, restrict input sources for JSON Patch operations or disable JSON Patch functionality entirely. Monitor applications using cJSON for crashes or stack overflow errors.

Hi! I’m here to help you understand CVE-2026-67215. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70