CVE-2026-86319
Received Received - Intake

Resource Consumption in json-patch Patch Operation Handler

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86319
EUVD
EUVD-2026-72448

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
github fge_jsonpatch to 1.13 (inc)
java-json-tools json-patch to 1.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86319 is a Denial of Service (DoS) vulnerability in the java-json-tools json-patch library up to version 1.13. It affects the JsonPatch.apply() method in the Patch Operation Handler component. The vulnerability allows remote attackers to consume excessive server resources by sending crafted JSON Patch documents with thousands of operations. Each operation triggers deep copying of nodes, leading to O(N×M) resource consumption where N is operations and M is document size. This can cause CPU and memory exhaustion, blocking server threads and potentially crashing the system.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU or memory usage on systems using json-patch library version 1.13 or earlier. Check application logs for slow or blocked requests during JSON Patch operations. Use network monitoring tools to identify requests with large JSON Patch documents containing thousands of operations.

Impact Analysis

If you use the affected json-patch library in your application, this vulnerability could allow attackers to send malicious JSON Patch requests that consume all available server resources. This may lead to degraded performance, application crashes, or complete service unavailability. Systems with limited resources or high request volumes are particularly vulnerable. The attack requires no authentication, making any endpoint accepting JSON Patch susceptible.

Compliance Impact

This vulnerability primarily causes resource consumption leading to denial of service, which may indirectly impact compliance by disrupting availability of systems handling sensitive data. GDPR requires data availability and security measures; prolonged outages could hinder compliance. HIPAA mandates timely access to protected health information; service disruptions may violate this requirement.

Mitigation Strategies

Immediately upgrade to a patched version of json-patch if available. Implement a maximum operation limit (e.g., 10,000) for JSON Patch requests. Add timeouts to JSON Patch operations to prevent long-running requests. Use structural sharing or copy-on-write mechanisms to reduce memory overhead during patch operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86319. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart