CVE-2026-67215
Description
A flaw was found in cJSON. A remote attacker can exploit this vulnerability by applying a specially crafted JSON Patch document that causes uncontrolled recursion, leading to stack exhaustion. This can result in a denial of service (DoS) by crashing the application.
Statement
A denial of service vulnerability was found in cJSON. When an application applies an untrusted RFC 6902 JSON Patch document via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(), a patch using add and copy operations can graft duplicated subtrees to amplify document nesting beyond the parser's limit. The subsequent unbounded recursion in cJSON_Delete() exhausts the thread stack and crashes the process.
Red Hat rates the impact of this flaw as Important. The impact is limited to availability (denial of service); there is no effect on confidentiality or integrity. Exploitation requires the application to apply an attacker-controlled JSON Patch document using the vulnerable cJSON-Utils functions; applications that do not process untrusted JSON Patch input are not affected.
The rpm-ostree component shipped in Red Hat Enterprise Linux and Red Hat OpenShift Container Platform is not affected: its 'cjson' dependency is the unrelated Rust cjson crate (a canonical-JSON serializer), not DaveGamble's C cJSON library, and it does not exercise the vulnerable code path.
Mitigation
To reduce the risk of exploitation, do not apply RFC 6902 JSON Patch documents originating from untrusted or unauthenticated sources using cJSON's cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() functions. Where the JSON Patch feature is not required, avoid calling these functions on externally supplied input. Applications that must process untrusted patch documents should enforce input size and nesting-depth limits before passing data to cJSON. This issue is a design limitation in cJSON's recursive handling and has no upstream fix as of version 1.7.19.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash.
Confidentiality
Technical Impact: Read Application Data
In some cases, an application's interpreter might kill a process or thread that appears to be consuming too much resources, such as with PHP's memory_limit setting. When the interpreter kills the process/thread, it might report an error containing detailed information such as the application's installation path.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
