CVE-2026-67215: cJSON Denial of Service Vulnerability

CVE-2026-67215 Overview

CVE-2026-67215 is an uncontrolled recursion vulnerability [CWE-674] in cJSON through version 1.7.19. The flaw resides in the JSON Patch handling routines cJSONUtils_ApplyPatches() and cJSONUtils_ApplyPatchesCaseSensitive(). An attacker who can supply an untrusted RFC 6902 JSON Patch document can craft add and copy operations that graft duplicated subtrees, amplifying document depth beyond the parser's nesting limit. The recursive cJSON_Delete() call has no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit. This causes stack exhaustion and process crash, resulting in denial of service.

Critical Impact
A remote attacker supplying a crafted JSON Patch to an application using cJSON can trigger stack exhaustion and crash the host process, producing a denial-of-service condition without authentication or user interaction.

Affected Products

cJSON library versions through 1.7.19
Applications using cJSONUtils_ApplyPatches() on untrusted input
Applications using cJSONUtils_ApplyPatchesCaseSensitive() on untrusted input

Discovery Timeline

2026-07-29 - CVE-2026-67215 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67215

Vulnerability Analysis

The vulnerability arises in cJSON's RFC 6902 JSON Patch application logic. When a patch document containing add and copy operations is applied, the library duplicates existing subtrees and grafts them back into the target document. Repeated copy operations targeting previously duplicated nodes exponentially amplify the document's nesting depth.

The root of the crash lies in two unbounded recursive routines. cJSON_Delete() walks the object tree recursively without any depth cap. cJSON_Duplicate() enforces a circular-reference guard, but the CJSON_CIRCULAR_LIMIT constant is set to 10000, which is ten times the parser's 1000-level nesting limit and large enough to overrun a default thread stack. The library's parser depth limit therefore fails to bound recursion in downstream operations.

The result is a denial-of-service primitive against any process that applies attacker-supplied JSON Patch documents using the vulnerable cJSON utility functions.

Root Cause

The root cause is a mismatch between the parser's nesting protection and the recursion limits in the tree-manipulation helpers. cJSON_Delete() performs no depth checking. cJSON_Duplicate() uses a circular guard set to 10000, well above the safe recursion depth on standard thread stacks. JSON Patch add and copy operations bypass the parser's original depth constraint by constructing deep trees at runtime.

Attack Vector

The attack requires network reachability to an application that accepts and applies RFC 6902 JSON Patch documents through cJSON. No authentication or user interaction is required. The attacker submits a crafted patch document containing add and copy operations designed to grow the target document depth past the safe recursion limit. When cJSON later invokes cJSON_Delete() or cJSON_Duplicate() on the grafted tree, the stack overflows and the host process terminates.

No verified proof-of-concept code has been published. Refer to the VulnCheck cJSON Security Advisory and the CVE Vulnerabilities Analysis for technical details.

Detection Methods for CVE-2026-67215

Indicators of Compromise

Unexpected process termination or SIGSEGV crashes in services that consume JSON Patch input
Inbound HTTP requests carrying application/json-patch+json payloads with unusually deep add and copy operation chains
Repeated short-lived crashes of worker processes shortly after receiving patch requests from a single source

Detection Strategies

Inspect request bodies destined for endpoints that process JSON Patch and flag documents whose nesting depth or operation count exceeds application norms
Monitor for cJSON_Delete and cJSON_Duplicate frames in stack traces or core dumps from crashing processes linked against cJSON
Correlate application crash telemetry with source IP addresses submitting patch payloads to identify probing behavior

Monitoring Recommendations

Enable core dump collection on services linking cJSON 1.7.19 or earlier and forward crash telemetry to a centralized log store
Track request volume and body size on JSON Patch endpoints and alert on anomalous spikes
Maintain a software bill of materials that identifies binaries statically linking cJSON so operators can scope exposure quickly

How to Mitigate CVE-2026-67215

Immediate Actions Required

Identify all applications and containers that ship cJSON at version 1.7.19 or earlier
Disable or gate JSON Patch endpoints exposed to untrusted callers until a fixed build is deployed
Enforce strict size and depth limits on incoming JSON Patch documents at the reverse proxy or API gateway
Add authentication and rate limits to any endpoint that accepts patch documents

Patch Information

At the time of publication, no fixed release version is listed in the NVD entry for CVE-2026-67215. Track the cJSON GitHub repository for a release that bounds recursion in cJSON_Delete() and lowers CJSON_CIRCULAR_LIMIT to a value below the parser's 1000-level nesting limit. Review the VulnCheck cJSON Security Advisory for updated remediation guidance.

Workarounds

Reject JSON Patch documents whose serialized size or operation count exceeds a conservative threshold before passing them to cJSON
Pre-parse and reject patches containing more than a small number of copy operations targeting nested paths
Run services that process untrusted patch input under a supervisor that restarts crashed workers and rate-limits repeat offenders
Increase per-thread stack size only as a temporary buffer, recognizing this does not eliminate the underlying flaw

bash

# Configuration example: enforce request body and depth limits at the gateway
# nginx example limiting JSON Patch body size
location /api/patch {
    client_max_body_size 8k;
    limit_req zone=patch_zone burst=5 nodelay;
    proxy_pass http://backend;
}