PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-67217 DaveGamble CVE debrief

An attacker who can supply a patch document to the cJSON library can destroy addressable members of the target document even though the API reports that the patch failed. This occurs because cJSON applies RFC 6902 JSON Patch operations non-atomically, allowing the target document to be mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status.

Vendor
DaveGamble
Product
cJSON
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-29
Original CVE updated
2026-10-23
Advisory published
2026-07-29
Advisory updated
2026-10-23

Who should care

Defenders responsible for systems or applications that utilize the cJSON library should assess their exposure and prioritize verifying the integrity of patch documents and validating patch operations to prevent unintended modifications to target documents.

Why it matters

CVE-2026-67217 allows attackers to destroy addressable members of target documents via non-atomic patch operations in the cJSON library. Defenders should prioritize verifying patch document integrity and validating patch operations to prevent data destruction and ensure target document integrity.

  • Defenders must verify patch document integrity to prevent data destruction
  • Defenders should validate patch operations to ensure target document integrity
  • Defenders need to monitor patch operations to detect potential attacks
  • Defenders may need to implement compensating controls to mitigate attack impact

Technical summary

The cJSON library applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated. This allows an attacker who can supply the patch document to destroy addressable members of the target document even though the API reports that the patch failed.

Defensive priority

Defenders should prioritize verifying the integrity of patch documents and validating patch operations to prevent unintended modifications to target documents.

Recommended defensive actions

  • Verify the integrity of patch documents before applying them
  • Validate patch operations to ensure they do not cause unintended modifications to target documents
  • Monitor for and track patch operations to detect potential attacks
  • Consider implementing compensating controls to mitigate the impact of a successful attack
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The cJSON library's source code and additional references are also available for further analysis.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-67217 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-67217

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-67217 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-67217

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c

    [email protected] - Patch

  • Source reference

    Unverified legacy reference

    URL: https://joshua.hu/cjson-json-parser-cve-vulnerabilities

    [email protected] - Exploit, Press/Media Coverage, Third Party Advisory

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation

    [email protected] - Third Party Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.