EUVD-2026-50329
GHSA-pr46-97qf-f32c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector reflects library use in network-facing services; no privilege required to supply a patch document; scope unchanged and impact limited to low integrity loss with no confidentiality or availability effect.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.
AnalysisAI
Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently corrupt the target JSON structure even when the API returns a failure status. The apply_patch() function in cJSON_Utils.c deletes existing target members before completing operation validation, meaning a malformed replace (missing value) or move (unresolvable destination) permanently destroys data from the in-memory document tree - defeating the RFC 6902 all-or-nothing contract that callers rely on to reject bad patches safely. No public exploit has been identified at time of analysis, but a detailed researcher disclosure and direct source code reference are publicly available, which may lower the barrier to exploitation; KEV status is not confirmed.
Technical ContextAI
cJSON is a lightweight, open-source JSON library written in C, maintained by Dave Gamble (CPE: cpe:2.3:a:davegamble:cjson). The affected functionality implements RFC 6902 JSON Patch operations via apply_patch() in cJSON_Utils.c (lines 887-948 of the v1.7.19 source). CWE-696 (Incorrect Behavior Order) precisely describes the root cause: the library detaches and frees the existing target node from the document tree before validating that the replacement value is present or that the move destination path is resolvable. RFC 6902 mandates atomic semantics - all patch operations succeed together or the document is left unchanged. cJSON violates this invariant by sequencing deletion ahead of validation, producing irreversible in-memory mutations even when the function ultimately signals failure. Both cJSONUtils_ApplyPatches() and cJSONUtils_ApplyPatchesCaseSensitive() are affected entry points.
RemediationAI
No vendor-released patch has been identified at time of analysis; the most recent confirmed-affected version is 1.7.19. Operators should monitor the upstream repository at https://github.com/DaveGamble/cJSON for a patched release and upgrade immediately upon availability. As a compensating control, applications that require atomic patch semantics should deep-copy the target cJSON object before invoking cJSONUtils_ApplyPatches() and restore from that copy on any non-success return - this trades a memory allocation per patch call for correctness guarantees and is the most robust workaround. Alternatively, pre-validate patch documents before submission by rejecting any operation array that contains a replace without a value member or a move whose to path does not exist in the current document; this adds per-call validation logic but eliminates the vulnerable deletion-before-validation sequence. Where patch input originates from untrusted external sources, restricting permitted operation types to add and remove (which do not trigger the affected code paths) eliminates exposure at the cost of reduced RFC 6902 coverage. See the VulnCheck advisory for additional context.
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c
cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments. Rated critical severity (CVSS 9.8), this
cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal. Rated critical severity (CVSS 9.8)
Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can r
Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can resu
cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of func
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c. Rated
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c. Ra
DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. Rated high severity (
Heap use-after-free in DaveGamble cJSON's cJSONUtils_MergePatch function (cJSON_Utils.c) affects all versions through 1.
Denial of service in cJSON (DaveGamble's C JSON parser) through version 1.7.19 lets a remote attacker crash any applicat
Denial of service in the cJSON C library (versions through 1.7.19) arises from exponential algorithmic complexity in the
Same weakness CWE-696 – Incorrect Behavior Order
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today