CVE-2026-29036

A flaw was found in cJSON, a JSON parser and generator. This vulnerability allows unauthenticated attackers to manipulate JSON Patch operations by supplying crafted JSON Pointer escape sequences. This can lead to silent corruption of data or the deletion of unintended keys, potentially bypassing authorization controls in applications that use cJSON for data modification. The flaw resides in the decode_pointer_inplace() function.

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker could compromise application data integrity by silently altering or deleting restricted parameters without proper authorization. Within Red Hat environments, overall exposure depends on whether higher-level services process RFC 6902 patch requests from untrusted network sources. Although core Red Hat Enterprise Linux distributions do not ship this component directly, affected layered services that rely on patch evaluation routines face significant integrity risks when processing malformed escape characters.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.