CVE-2026-29036: cJSON Auth Bypass Vulnerability

CVE-2026-29036 Overview

CVE-2026-29036 is a vulnerability in the cJSON library affecting versions 1.5.0 through 1.7.19. The flaw resides in the decode_pointer_inplace() function within cJSON_Utils.c and stems from incorrect resolution of JSON Pointer escape sequences (~0 and ~1) during RFC 6902 JSON Patch operations. Unauthenticated attackers can supply crafted patch paths that cause cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to target the wrong object keys. This enables silent data corruption, deletion of unintended keys, and potential authorization bypass in applications that rely on JSON Patch for access-controlled data modification. The issue is classified under [CWE-706] (Use of Incorrectly-Resolved Name or Reference).

Critical Impact
Remote attackers can silently corrupt JSON data structures and bypass key-based authorization controls without authentication or user interaction.

Affected Products

cJSON versions 1.5.0 through 1.7.19
Applications invoking cJSONUtils_ApplyPatches()
Applications invoking cJSONUtils_ApplyPatchesCaseSensitive()

Discovery Timeline

2026-08-11 - CVE-2026-29036 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-29036

Vulnerability Analysis

The cJSON library implements RFC 6902 JSON Patch operations through helper functions in cJSON_Utils.c. JSON Patch relies on JSON Pointers (RFC 6901) to identify target locations within a document. JSON Pointer syntax reserves two escape sequences: ~0 represents a literal ~, and ~1 represents a literal /.

The decode_pointer_inplace() function incorrectly resolves these escape sequences when parsing patch paths. As a result, a crafted pointer such as /foo~01bar may resolve to a different key than the RFC-compliant target. Applications processing attacker-supplied patches will then modify or delete the wrong object member.

Because the operation succeeds without error, the corruption is silent. Applications that gate write access on specific key names can be tricked into modifying protected keys via aliased pointer paths.

Root Cause

The root cause is improper name resolution in the JSON Pointer decoder. The escape-decoding logic in decode_pointer_inplace() does not correctly enforce the RFC 6901 rule that ~ must only be followed by 0 or 1. This produces an ambiguity between distinct pointer strings, allowing multiple encodings to reference the same or unintended keys.

Attack Vector

An unauthenticated remote attacker submits a JSON Patch document containing crafted pointer paths with malicious ~0 or ~1 sequences. When the target application calls cJSONUtils_ApplyPatches() on attacker-controlled input, the patch is applied against the wrong key. This can overwrite privileged fields, delete integrity-critical data, or bypass access checks that assume pointer paths uniquely identify a member. No authentication, privileges, or user interaction are required.

No verified public proof-of-concept code is available. Refer to the VulnCheck Security Advisory for further technical detail.

Detection Methods for CVE-2026-29036

Indicators of Compromise

JSON Patch requests containing unusual ~0 or ~1 escape sequences in path or from fields, particularly repeated or nested patterns such as ~01 or ~10.
Unexpected modifications or deletions of object keys immediately following JSON Patch API requests.
Application logs showing successful patch operations against keys that should be inaccessible to the requester.

Detection Strategies

Inspect inbound application/json-patch+json payloads at the API gateway and flag paths containing tilde escape sequences for review.
Perform software composition analysis on build artifacts to identify vulnerable cJSON versions between 1.5.0 and 1.7.19.
Correlate JSON Patch request payloads with subsequent write events to detect divergence between intended and actual target keys.

Monitoring Recommendations

Enable verbose application logging around cJSONUtils_ApplyPatches() and cJSONUtils_ApplyPatchesCaseSensitive() call sites to capture full patch documents.
Alert on repeated JSON Patch failures or anomalous patch volume from a single source, which may indicate probing for pointer-decoding behavior.
Monitor integrity-sensitive fields (roles, permissions, ownership) for changes originating from patch endpoints.

How to Mitigate CVE-2026-29036

Immediate Actions Required

Inventory all applications and firmware that statically or dynamically link against cJSON versions 1.5.0 through 1.7.19.
Upgrade to a patched cJSON release once available from the upstream GitHub cJSON Repository.
Restrict access to endpoints that accept RFC 6902 JSON Patch input from untrusted sources until the library is updated.

Patch Information

Monitor the GitHub cJSON Repository for a fixed release addressing the escape decoding logic in decode_pointer_inplace(). Consult the VulnCheck Security Advisory for authoritative fix guidance and version tracking.

Workarounds

Validate JSON Patch paths at the application layer before invoking cJSON, rejecting any path containing ~ sequences other than a strict ~0 or ~1 followed by non-tilde characters.
Enforce an allowlist of permitted patch target paths for each authenticated principal and reject any patch operation outside that allowlist.
Disable JSON Patch functionality entirely on public-facing endpoints where full document replacement can be used instead.

bash

# Configuration example: strict path validation at ingress
# Reject any JSON Patch containing suspicious tilde encodings
if echo "$PATCH_BODY" | grep -Eq '"(path|from)"[[:space:]]*:[[:space:]]*"[^"]*~([^01]|0[0-9]|1[0-9])'; then
  echo "Rejected: suspicious JSON Pointer escape"
  exit 1
fi