CVE-2026-67215 DaveGamble CVE debrief

Who should care

Developers and administrators who use the cJSON library in their applications should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating the library to a version that is not vulnerable, implementing input validation and sanitization for JSON Patch documents, and monitoring for suspicious activity.

Why it matters

CVE-2026-67215 is a vulnerability in the cJSON library that can lead to a denial-of-service (DoS) attack when an untrusted RFC 6902 JSON Patch is applied. The vulnerability is caused by uncontrolled recursion leading to stack exhaustion. An attacker who can supply the patch document can crash the process, resulting in a denial of service.

• Denial of service (DoS) attacks are possible
• Crash of the process can occur
• Uncontrolled recursion can lead to stack exhaustion

Technical summary

The cJSON library is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied. This can lead to a denial-of-service (DoS) attack. The vulnerability is rated as High with a CVSS score of 8.7. The vulnerability is caused by the cJSON_Delete() function recursing with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, which is ten times the parser's 1000-level nesting limit. An attacker who can supply the patch document can crash the process, resulting in a denial of service. The vulnerability affects systems that use the cJSON library and process JSON Patch documents.

Defensive priority

High

Recommended defensive actions

• Review and update cJSON library to a version that is not vulnerable
• Implement input validation and sanitization for JSON Patch documents
• Monitor for suspicious activity and implement logging and alerting
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems
• Review and update incident response plans to address potential DoS attacks
• Track and analyze system logs for potential security incidents

Evidence notes

The vulnerability is caused by uncontrolled recursion in the cJSON library when applying an untrusted RFC 6902 JSON Patch. This can lead to stack exhaustion and a denial-of-service (DoS) attack. The vulnerability is rated as High with a CVSS score of 8.7.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.