Skip to main content

cJSON EUVDEUVD-2026-57008

| CVE-2026-29036 HIGH
Use of Incorrectly-Resolved Name or Reference (CWE-706)
2026-08-11 disclosure@vulncheck.com GHSA-89cr-7g9x-rjgw
Information Disclosure Red Hat Suse
8.7
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable, no authentication per description; integrity-only impact as flaw silently misdirects writes with no data exposure or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 11, 2026 - 22:42 vuln.today
CVE Published
Aug 11, 2026 - 22:17 cve.org
HIGH 8.7

DescriptionCVE.org

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.

AnalysisAI

Incorrect JSON Pointer escape-sequence decoding in cJSON versions 1.5.0 through 1.7.19 allows unauthenticated network attackers to redirect RFC 6902 JSON Patch operations to unintended object keys by supplying crafted ~0 or ~1 sequences in patch paths. Any application that exposes cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to external input is vulnerable to silent data corruption, unintended key deletion, and potential authorization bypass when JSON Patch is used to gate access-controlled modifications. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface and high integrity impact (CVSS 4.0: 8.7) make this a meaningful risk for any service built on cJSON's utility layer.

Technical ContextAI

cJSON is a lightweight, single-file ANSI C JSON parser widely embedded in IoT firmware, embedded systems, and native application backends. The vulnerability resides in decode_pointer_inplace() within cJSON_Utils.c, which implements RFC 6901 JSON Pointer resolution for use by the RFC 6902 JSON Patch functions. RFC 6901 defines two escape sequences: ~0 (representing the tilde character ~) and ~1 (representing the forward slash /). CWE-706 (Use of Incorrectly-Resolved Name or Reference) captures the root cause: the function resolves these escape sequences in a way that maps a crafted pointer string to a different key than the patch specification intends. Because JSON Pointer strings are caller-supplied in patch operations, any application that forwards untrusted patch documents directly to cJSONUtils_ApplyPatches() inherits this flaw without any additional misconfiguration required. The affected CPE range spans cJSON 1.5.0 through 1.7.19 as stated in the vulnerability description.

RemediationAI

No vendor-released patch version has been independently confirmed at time of analysis - the available references point to the upstream repository (https://github.com/DaveGamble/cJSON) and the VulnCheck advisory (https://www.vulncheck.com/advisories/cjson-wrong-key-modification-via-json-pointer-escape-decoding) but do not specify a fixed release tag. Operators should monitor the cJSON GitHub repository for a patched release and upgrade as soon as one is available. As a compensating control, applications should validate and sanitize JSON Pointer strings in incoming patch documents before passing them to cJSONUtils_ApplyPatches(), specifically rejecting or normalizing ~0 and ~1 sequences at the application boundary before they reach cJSON_Utils. A secondary control is to restrict which keys are patchable by constructing a server-side allowlist of permitted patch paths and rejecting any patch document that references a path outside that list - this limits the blast radius of an incorrect pointer resolution even if the library bug is triggered. If JSON Patch is used solely for internal, trusted operations (not exposed to external callers), the risk is substantially reduced and the flaw may be tolerable until a patch is released, though this should be verified against the actual trust boundary of the deployment.

Same weakness CWE-706 – Use of Incorrectly-Resolved Name or Reference

View all
CVE-2021-40539 CRITICAL POC
9.8
CVE-2020-15505 CRITICAL POC
9.8
CVE-2019-8908 CRITICAL POC
9.8
CVE-2019-7731 CRITICAL POC
9.8
CVE-2021-37144 CRITICAL POC
9.1
CVE-2023-28643 HIGH POC
8.8
CVE-2024-27295 HIGH POC
8.2
CVE-2026-25890 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

EUVD-2026-57008 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy