CVE-2026-86318: java-json-tools Buffer Overflow Vulnerability

CVE-2026-86318 Overview

CVE-2026-86318 affects the java-json-tools/json-patch library up to version 1.13. The flaw resides in the JsonMergePatch.fromJson function within JsonMergePatchDeserializer.java. An attacker can trigger a stack-based buffer overflow [CWE-119] by supplying crafted JSON input to the deserializer. The vulnerability is exploitable remotely without authentication or user interaction. A public exploit has been disclosed, and the maintainers were notified through an issue report but have not responded at the time of publication.

Critical Impact
Remote attackers can crash Java applications that deserialize untrusted JSON merge patches, resulting in denial of service against services embedding the vulnerable library.

Affected Products

java-json-tools/json-patch versions up to and including 1.13
Java applications that call JsonMergePatch.fromJson on untrusted input
Downstream libraries and frameworks that transitively depend on json-patch

Discovery Timeline

2026-09-07 - CVE-2026-86318 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86318

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). It occurs in the JsonMergePatch.fromJson method of JsonMergePatchDeserializer.java, which parses and deserializes RFC 7396 JSON merge patch documents. When the deserializer processes attacker-controlled JSON, execution can exceed the intended stack boundary. Because the affected code path is reachable from any network-facing endpoint that accepts JSON patch payloads, the attack complexity is low and requires no privileges or user interaction.

Root Cause

The root cause lies in how JsonMergePatchDeserializer handles recursive or deeply nested JSON structures during merge-patch construction. Insufficient depth or bounds validation on the input allows the parsing routine to consume stack frames beyond safe limits. This condition maps to CWE-119, where the operation is not properly restricted to the buffer's allocated memory region.

Attack Vector

Exploitation is network-based. An attacker submits a crafted JSON merge patch document to any application endpoint that forwards the payload to JsonMergePatch.fromJson. No authentication is required. The primary observed impact is availability loss through process termination or thread exhaustion. Public exploit details are available through the referenced VulDB entry for CVE-2026-86318 and the GitHub Issue #168 discussion.

No verified proof-of-concept code is reproduced here. Refer to the linked issue tracker and vulnerability database entries for technical reproduction details.

Detection Methods for CVE-2026-86318

Indicators of Compromise

Java stack traces originating from JsonMergePatchDeserializer.deserialize or JsonMergePatch.fromJson containing StackOverflowError.
Unexpected application or JVM restarts correlated with inbound HTTP requests carrying Content-Type: application/merge-patch+json.
Repeated PATCH requests from a single source with abnormally large or deeply nested JSON bodies.

Detection Strategies

Perform software composition analysis (SCA) to identify direct and transitive dependencies on com.github.java-json-tools:json-patch at versions 1.13 or earlier.
Instrument application logs to capture StackOverflowError exceptions and alert when they originate from the JSON patch deserializer.
Deploy a web application firewall (WAF) rule to inspect JSON merge patch payload depth and reject requests exceeding safe nesting thresholds.

Monitoring Recommendations

Monitor JVM crash reports and container restart counts for services exposing PATCH endpoints.
Track request rates and payload sizes on endpoints that accept application/merge-patch+json or application/json-patch+json.
Correlate application error telemetry with upstream network sources to identify probing activity against the deserializer.

How to Mitigate CVE-2026-86318

Immediate Actions Required

Inventory all Java services that include json-patch 1.13 or earlier as a direct or transitive dependency.
Restrict exposure of endpoints that deserialize untrusted JSON merge patch input, especially those reachable from the public internet.
Enforce request size and JSON nesting depth limits at the reverse proxy or API gateway layer.

Patch Information

As of the last NVD update on 2026-09-08, no vendor patch has been released. The maintainers were notified through the GitHub Issue #168 Discussion but had not responded at the time of publication. Monitor the GitHub JSON Patch Repository for a fixed release and consult the VulDB CVE-2026-86318 entry for updates.

Workarounds

Validate incoming JSON payloads for maximum depth and size before passing them to JsonMergePatch.fromJson.
Wrap deserialization calls in isolated threads with bounded stack sizes to contain StackOverflowError events.
Consider migrating to an alternative RFC 7396 implementation, such as the merge-patch support in Jackson JsonPatch modules, until a fix is published.

bash

# Configuration example: enforce JSON depth limits with a Jackson ObjectMapper
# StreamReadConstraints was introduced in Jackson 2.15+
StreamReadConstraints constraints = StreamReadConstraints.builder()
    .maxNestingDepth(100)
    .maxNumberLength(1000)
    .maxStringLength(1_000_000)
    .build();

ObjectMapper mapper = new ObjectMapper();
mapper.getFactory().setStreamReadConstraints(constraints);