Denial of Service Vulnerability in cJSON Library (CVE-2026-67215)

CVE-2026-67215 details a high-severity denial-of-service vulnerability affecting the cJSON library through version 1.7.19. This flaw stems from uncontrolled recursion when applying a specially crafted RFC 6902 JSON Patch via the cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() functions. An attacker can create a JSON Patch that, through add and copy operations, grafts duplicated subtrees within a JSON document. This process amplifies the document's depth beyond the parser's intended nesting limits, eventually reaching the CJSON_CIRCULAR_LIMIT configured in the library. When the affected application attempts to free this malformed JSON structure using cJSON_Delete(), the recursive deletion process, which lacks a depth bound, causes stack exhaustion and crashes the process. This allows an unauthenticated attacker to induce a denial-of-service condition in any application using the vulnerable cJSON version to process untrusted JSON patches.

Attack Chain

1. An attacker prepares a malicious RFC 6902 JSON Patch document containing add and copy operations designed to duplicate and graft subtrees.
2. The attacker submits this malicious JSON Patch to an application that uses the vulnerable cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() functions.
3. The cJSON library applies the patch, creating a JSON document with an excessively deep structure, exceeding the parser's 1000-level nesting limit and potentially the CJSON_CIRCULAR_LIMIT (10000).
4. When the application later attempts to free the malformed JSON document using cJSON_Delete(), the function initiates an uncontrolled recursive traversal.
5. The unbounded recursion within cJSON_Delete() causes the application's thread stack to exhaust.
6. The stack exhaustion leads to an application crash.
7. The application becomes unavailable, resulting in a denial-of-service condition for legitimate users.

Impact

Successful exploitation of CVE-2026-67215 results in a denial-of-service condition for applications utilizing the vulnerable cJSON library (versions through 1.7.19). An attacker can crash the target process by supplying a crafted JSON Patch, rendering the service or application inaccessible. While no specific victim counts or targeted sectors are mentioned, any application processing untrusted RFC 6902 JSON Patches with affected cJSON versions is susceptible to this availability impact.

Recommendation

1. Upgrade the cJSON library to a version patched against CVE-2026-67215 immediately.
2. Implement robust input validation and sanitization for all incoming RFC 6902 JSON Patch documents to prevent malicious structures from being processed by cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive().
3. Monitor application logs for sudden process crashes or stack overflow errors, which could indicate attempted exploitation of CVE-2026-67215.