CVE-2026-67217: cJSON JSON Patch Integrity Vulnerability

CVE-2026-67217 Overview

CVE-2026-67217 affects the cJSON library through version 1.7.19. The vulnerability resides in the apply_patch() function within cJSON_Utils.c, which implements RFC 6902 JSON Patch operations. The implementation applies patches non-atomically. A malformed replace operation missing its value member, or a move operation with an unresolvable destination path, causes the target member to be detached and deleted before validation completes. cJSONUtils_ApplyPatches() and cJSONUtils_ApplyPatchesCaseSensitive() return a failure status, yet the target document has already been mutated. This defeats the all-or-nothing semantics callers depend on to reject bad patches.

Critical Impact
An attacker who controls the patch document can destroy addressable members of the target JSON document while the API reports the patch failed, corrupting data integrity in applications that trust the failure status.

Affected Products

cJSON library versions through 1.7.19
Applications embedding cJSON_Utils.c for RFC 6902 JSON Patch processing
Downstream software linking cJSON for JSON manipulation workflows

Discovery Timeline

2026-07-29 - CVE-2026-67217 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67217

Vulnerability Analysis

The flaw is an incorrect behavioral order violation classified under [CWE-696] (Incorrect Behavior Order). RFC 6902 requires JSON Patch application to be atomic. If any operation in the patch sequence fails, the target document must remain unchanged. cJSON's apply_patch() violates this contract by performing destructive mutations before completing validation of each operation.

For a replace operation, the implementation locates and detaches the existing target member prior to verifying that the incoming value field exists. When value is absent, the function returns an error, but the original member has already been freed. A similar defect exists in move operations: the source member is removed before the destination path is resolved. If the destination is invalid, the move fails while the source data has been destroyed.

Callers that rely on the returned failure status to guarantee document integrity will operate on silently corrupted state. Applications using cJSON for configuration management, distributed state synchronization, or transactional document updates are directly exposed.

Root Cause

The root cause is missing pre-validation of patch operands before mutation. The apply_patch() routine interleaves validation and mutation instead of validating the entire operation, executing the change, and rolling back on error. There is no snapshot or transactional wrapper around the target document.

Attack Vector

The attack vector is network-reachable when the application accepts JSON Patch documents from untrusted sources over HTTP, message queues, or other transports. An attacker submits a patch containing a malformed replace (omitting value) or a move with an invalid destination path targeting a sensitive member. The API returns failure, but the targeted member is destroyed. No authentication or user interaction is required if the patch endpoint is exposed.

See the GitHub cJSON Code Reference, Joshua's CVE Vulnerability Analysis, and the VulnCheck Security Advisory for technical details.

Detection Methods for CVE-2026-67217

Indicators of Compromise

Application logs showing cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returning non-zero failure codes followed by unexpected document state
Inbound JSON Patch requests containing replace operations that omit the value member
Inbound move operations referencing destination paths that do not resolve in the target document
Post-patch integrity check failures on JSON documents managed by cJSON

Detection Strategies

Instrument the patch handling layer to compare document hashes before and after failed patch calls; any drift indicates exploitation
Add server-side validation of incoming patch operations to reject malformed replace and unresolvable move operations prior to invoking cJSON
Enable structured logging on all patch API endpoints, capturing operation type, path, and result status

Monitoring Recommendations

Alert on elevated rates of failed JSON Patch API calls from a single source, which may indicate probing
Monitor for correlated patterns of patch failures followed by application errors referencing missing configuration keys or fields
Track anomalous edits to documents whose only recent modification was a failed patch operation

How to Mitigate CVE-2026-67217

Immediate Actions Required

Inventory all services and dependencies that embed cJSON versions through 1.7.19 and use cJSON_Utils.c patch functions
Disable or gate exposed JSON Patch endpoints that accept untrusted input until a fixed release is available
Add an application-layer pre-validator that rejects replace without value and verifies move destination paths before calling cJSON

Patch Information

No fixed upstream release is referenced in the current NVD entry. Monitor the cJSON GitHub repository for a release addressing the non-atomic patch behavior and consult the VulnCheck Security Advisory for remediation updates.

Workarounds

Clone the target cJSON document before invoking cJSONUtils_ApplyPatches(), and discard the clone if the call returns failure
Wrap patch application in an application-level transaction that persists changes only on success
Enforce schema validation on incoming patch documents to reject malformed operations before they reach cJSON
Restrict patch endpoints with authentication and authorization to reduce untrusted input exposure

bash

# Configuration example: pre-clone before applying a patch
# Pseudocode illustrating a safe wrapper around cJSON patch calls
#   cJSON *snapshot = cJSON_Duplicate(target, 1);
#   int rc = cJSONUtils_ApplyPatches(target, patch);
#   if (rc != 0) {
#       cJSON_Delete(target);
#       target = snapshot;   // restore pre-patch state
#   } else {
#       cJSON_Delete(snapshot);
#   }