CVE-2026-67217: medium-severity vulnerability in DaveGamble cJSON
cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.4%
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
DaveGamble · cJSONpublic PoCs found — 1
cve_referencejoshua.hu/cjson-json-parser-cve-vulnerabilitiesunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — DaveGamble cJSON
In the same product, most dangerous first.
CVE-2026-67215HIGHcJSON JSON Patch copy/add Uncontrolled Recursion Stack ExhaustionEPSS 0.7%CVE-2026-67216HIGHcJSON cJSON_Compare Exponential Complexity Denial of ServiceEPSS 0.6%CVE-2026-87933MEDIUMDaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after freeEPSS 0.5%CVE-2026-29036HIGHcJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape DecodingEPSS 0.4%CVE-2026-16554MEDIUMInteger Overflow Leading to Heap Buffer Overflow in cJSONEPSS 0.4%