CVE-2026-67215

A flaw was found in cJSON. A remote attacker can exploit this vulnerability by applying a specially crafted JSON Patch document that causes uncontrolled recursion, leading to stack exhaustion. This can result in a denial of service (DoS) by crashing the application.

A denial of service vulnerability was found in cJSON. When an application applies an untrusted RFC 6902 JSON Patch document via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(), a patch using add and copy operations can graft duplicated subtrees to amplify document nesting beyond the parser's limit. The subsequent unbounded recursion in cJSON_Delete() exhausts the thread stack and crashes the process.

Red Hat rates the impact of this flaw as Important. The impact is limited to availability (denial of service); there is no effect on confidentiality or integrity. Exploitation requires the application to apply an attacker-controlled JSON Patch document using the vulnerable cJSON-Utils functions; applications that do not process untrusted JSON Patch input are not affected.

The rpm-ostree component shipped in Red Hat Enterprise Linux and Red Hat OpenShift Container Platform is not affected: its 'cjson' dependency is the unrelated Rust cjson crate (a canonical-JSON serializer), not DaveGamble's C cJSON library, and it does not exercise the vulnerable code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the risk of exploitation, do not apply RFC 6902 JSON Patch documents originating from untrusted or unauthenticated sources using cJSON's cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() functions. Where the JSON Patch feature is not required, avoid calling these functions on externally supplied input. Applications that must process untrusted patch documents should enforce input size and nesting-depth limits before passing data to cJSON. This issue is a design limitation in cJSON's recursive handling and has no upstream fix as of version 1.7.19.