CVE-2026-67217

Analyzed Analyzed - Analysis Complete

Memory Corruption in cJSON JSON Patch Handling

Publication date: 2026-07-29

Last updated on: 2026-08-04

Assigner: VulnCheck

Description

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67217

Affected Vendors & Products

Vendor	Product	Version / Range
davegamble	cjson	to 1.7.19 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-696	The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Attack-Flow Graph

Executive Summary

cJSON through 1.7.19 handles RFC 6902 JSON Patch operations non-atomically. When a replace operation lacks a value or a move operation's destination path is invalid, the existing target member is deleted before validation completes. This causes the target document to mutate even when the patch operation fails, breaking the expected all-or-nothing behavior.

Detection Guidance

This vulnerability involves improper handling of JSON Patch operations in cJSON. To detect it, inspect applications using cJSON versions up to 1.7.19 for improper patch validation. Check for patches with missing values or invalid paths that may cause partial document mutations. No specific commands are provided in the context.

Impact Analysis

An attacker supplying a malicious patch could delete critical data in the target JSON document despite the operation appearing to fail. This could lead to data loss, corruption, or unintended behavior in applications relying on cJSON for JSON patching.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or corruption, potentially violating integrity requirements in GDPR and HIPAA. If sensitive data is altered or lost due to this flaw, organizations may fail compliance checks for data integrity and protection.

Mitigation Strategies

Update cJSON to a version later than 1.7.19 where the patch operations are applied atomically to prevent document mutation during failed operations.

Hi! I’m here to help you understand CVE-2026-67217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70