{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/cjson/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-67215"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cJSON \u003c= 1.7.19"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","cJSON"],"_cs_type":"advisory","_cs_vendors":["cJSON"],"content_html":"\u003cp\u003eCVE-2026-67215 details a high-severity denial-of-service vulnerability affecting the cJSON library through version 1.7.19. This flaw stems from uncontrolled recursion when applying a specially crafted RFC 6902 JSON Patch via the \u003ccode\u003ecJSONUtils_ApplyPatches()\u003c/code\u003e or \u003ccode\u003ecJSONUtils_ApplyPatchesCaseSensitive()\u003c/code\u003e functions. An attacker can create a JSON Patch that, through \u003ccode\u003eadd\u003c/code\u003e and \u003ccode\u003ecopy\u003c/code\u003e operations, grafts duplicated subtrees within a JSON document. This process amplifies the document's depth beyond the parser's intended nesting limits, eventually reaching the \u003ccode\u003eCJSON_CIRCULAR_LIMIT\u003c/code\u003e configured in the library. When the affected application attempts to free this malformed JSON structure using \u003ccode\u003ecJSON_Delete()\u003c/code\u003e, the recursive deletion process, which lacks a depth bound, causes stack exhaustion and crashes the process. This allows an unauthenticated attacker to induce a denial-of-service condition in any application using the vulnerable cJSON version to process untrusted JSON patches.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker prepares a malicious RFC 6902 JSON Patch document containing \u003ccode\u003eadd\u003c/code\u003e and \u003ccode\u003ecopy\u003c/code\u003e operations designed to duplicate and graft subtrees.\u003c/li\u003e\n\u003cli\u003eThe attacker submits this malicious JSON Patch to an application that uses the vulnerable \u003ccode\u003ecJSONUtils_ApplyPatches()\u003c/code\u003e or \u003ccode\u003ecJSONUtils_ApplyPatchesCaseSensitive()\u003c/code\u003e functions.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecJSON\u003c/code\u003e library applies the patch, creating a JSON document with an excessively deep structure, exceeding the parser's 1000-level nesting limit and potentially the \u003ccode\u003eCJSON_CIRCULAR_LIMIT\u003c/code\u003e (10000).\u003c/li\u003e\n\u003cli\u003eWhen the application later attempts to free the malformed JSON document using \u003ccode\u003ecJSON_Delete()\u003c/code\u003e, the function initiates an uncontrolled recursive traversal.\u003c/li\u003e\n\u003cli\u003eThe unbounded recursion within \u003ccode\u003ecJSON_Delete()\u003c/code\u003e causes the application's thread stack to exhaust.\u003c/li\u003e\n\u003cli\u003eThe stack exhaustion leads to an application crash.\u003c/li\u003e\n\u003cli\u003eThe application becomes unavailable, resulting in a denial-of-service condition for legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-67215 results in a denial-of-service condition for applications utilizing the vulnerable cJSON library (versions through 1.7.19). An attacker can crash the target process by supplying a crafted JSON Patch, rendering the service or application inaccessible. While no specific victim counts or targeted sectors are mentioned, any application processing untrusted RFC 6902 JSON Patches with affected cJSON versions is susceptible to this availability impact.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ecJSON\u003c/code\u003e library to a version patched against CVE-2026-67215 immediately.\u003c/li\u003e\n\u003cli\u003eImplement robust input validation and sanitization for all incoming RFC 6902 JSON Patch documents to prevent malicious structures from being processed by \u003ccode\u003ecJSONUtils_ApplyPatches()\u003c/code\u003e or \u003ccode\u003ecJSONUtils_ApplyPatchesCaseSensitive()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for sudden process crashes or stack overflow errors, which could indicate attempted exploitation of CVE-2026-67215.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-29T14:20:12Z","date_published":"2026-07-29T14:20:12Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-67215-cjson-dos/","summary":"CVE-2026-67215 describes a denial-of-service vulnerability in cJSON through version 1.7.19, where an attacker can trigger uncontrolled recursion and stack exhaustion by supplying a crafted RFC 6902 JSON Patch to cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(), leading to process crash.","title":"Denial of Service Vulnerability in cJSON Library (CVE-2026-67215)","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-67215-cjson-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - CJSON","version":"https://jsonfeed.org/version/1.1"}