CVE-2026-86319 java-json-tools CVE debrief

Who should care

Defenders responsible for systems and applications that use the affected java-json-tools json-patch library version 1.13 or earlier should assess exposure to remote exploitation and verify inventory.

Why it matters

CVE-2026-86319 is a vulnerability in the java-json-tools json-patch library up to version 1.13 that can lead to resource consumption via remote exploitation. Defenders should verify inventory, assess exposure, and monitor for exploitation attempts.

• Verification of system and application inventory for affected java-json-tools json-patch library versions is required.
• Remote exploitation attempts may lead to increased resource consumption, potentially affecting system performance.
• Defenders should monitor for unusual patterns that could indicate exploitation attempts.

Technical summary

The vulnerability affects the JsonPatch.apply function in the JsonPatch.java file of the java-json-tools json-patch library up to version 1.13. This function is part of the Patch Operation Handler component. The vulnerability can lead to resource consumption and can be exploited remotely. Defenders should prioritize verifying the inventory of systems and applications that use the affected library and assess exposure to remote exploitation with source-grounded technical framing without unsupported root-cause or exploit claims.

Defensive priority

Defenders should prioritize verifying the inventory of systems and applications that use the affected java-json-tools json-patch library version 1.13 or earlier and assess exposure to remote exploitation.

Recommended defensive actions

• Verify the inventory of systems and applications that use the affected java-json-tools json-patch library version 1.13 or earlier.
• Assess exposure to remote exploitation.
• Monitor for unusual resource consumption patterns that could indicate exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected components. However, the record of exploitation and impact remains limited. Defenders should verify inventory, assess exposure, and monitor for exploitation attempts with explicit evidence-limit language and defensive verification tasks. Limited source detail exists on affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.