CVE-2026-86319: json-patch DOS Vulnerability

CVE-2026-86319 Overview

CVE-2026-86319 is a resource consumption vulnerability in the java-json-tools/json-patch library through version 1.13. The flaw resides in the JsonPatch.apply function within src/main/java/com/github/fge/jsonpatch/JsonPatch.java, part of the Patch Operation Handler component. An attacker can submit crafted JSON Patch documents that force the library to consume excessive resources, resulting in a denial-of-service condition. The vulnerability is remotely exploitable without authentication or user interaction. Public disclosure has occurred, and the maintainers were notified via an upstream issue report but have not yet responded. The weakness is classified under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Remote unauthenticated attackers can trigger availability degradation in any Java application that processes untrusted JSON Patch input using json-patch up to 1.13.

Affected Products

java-json-tools/json-patch versions up to and including 1.13
Java applications embedding the com.github.fge.jsonpatch package for RFC 6902 JSON Patch handling
Downstream services exposing REST APIs that apply client-supplied JSON Patch documents

Discovery Timeline

2026-09-07 - CVE-2026-86319 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86319

Vulnerability Analysis

The defect lives in the JsonPatch.apply method, which iterates through patch operations defined by RFC 6902 and applies them sequentially to a target JSON document. The handler does not enforce upper bounds on the computational cost or memory footprint incurred while processing an incoming patch. An attacker who controls the patch payload can craft operations that force the library into disproportionately expensive work relative to the input size.

Applications typically expose this code path through HTTP APIs that accept application/json-patch+json bodies. Because the parsing and application logic executes before any business validation, the resource pressure occurs on the request-handling thread. Sustained abuse degrades throughput for legitimate consumers of the same service.

Root Cause

The root cause is missing input governance in the Patch Operation Handler. JsonPatch.apply trusts the size, depth, and structural characteristics of user-supplied patch operations. There is no cap on operation count, target path depth, or intermediate document growth, which allows adversarial inputs to consume CPU cycles and heap memory in a manner disproportionate to the request. This aligns with [CWE-400: Uncontrolled Resource Consumption].

Attack Vector

Exploitation is fully remote and requires no authentication or user interaction. An attacker submits a malicious JSON Patch document to any endpoint that routes patch bodies into JsonPatch.apply. Repeated submissions from a single client, or a small number of concurrent requests, can exhaust worker threads or trigger heap pressure sufficient to disrupt service availability. Refer to the GitHub Issue #167 Discussion and the VulDB CVE-2026-86319 entry for additional technical context.

No verified proof-of-concept code is included here; consult the linked upstream issue for reproduction details.

Detection Methods for CVE-2026-86319

Indicators of Compromise

Sustained CPU saturation on JVM worker threads processing application/json-patch+json requests
Heap growth or OutOfMemoryError events correlated with inbound patch traffic
HTTP requests with anomalously large patch bodies or high operation counts directed at PATCH endpoints

Detection Strategies

Inventory Java services that import com.github.fge.jsonpatch and identify request paths that invoke JsonPatch.apply on untrusted input.
Instrument the patch-handling code path with request-level timing metrics and alert on outliers exceeding baseline execution time.
Deploy web application firewall rules that inspect JSON Patch bodies for excessive op array length or deeply nested path values.

Monitoring Recommendations

Track JVM heap, garbage collection frequency, and thread pool saturation on services exposing JSON Patch APIs.
Log source IPs, request sizes, and processing latency for every PATCH request and pipeline these into a SIEM for anomaly analysis.
Correlate spikes in 5xx responses with concurrent PATCH activity to surface resource-exhaustion patterns.

How to Mitigate CVE-2026-86319

Immediate Actions Required

Audit application dependency manifests for com.github.fge:json-patch at versions up to 1.13.
Enforce request body size limits and reject oversized JSON Patch payloads at the reverse proxy or API gateway.
Apply per-client rate limits on endpoints that expose patch functionality to reduce amplification impact.
Isolate patch-handling workloads behind bulkheads or dedicated thread pools to contain resource exhaustion.

Patch Information

At the time of publication, the upstream java-json-tools/json-patch project had not responded to the issue report and no fixed release is listed in the advisory. Monitor the GitHub JSON Patch Repository and GitHub Issue #167 Discussion for a patched version. Consumers should track the VulDB Vulnerability #399510 record for remediation updates.

Workarounds

Validate JSON Patch documents before invoking JsonPatch.apply, capping operation count and path depth.
Wrap JsonPatch.apply calls in execution timeouts using a bounded executor to abort long-running operations.
Consider migrating patch handling to an actively maintained alternative library that enforces resource limits.
Restrict PATCH endpoints to authenticated clients where feasible to reduce anonymous exposure.

bash

# Example gateway configuration: cap JSON Patch request size (NGINX)
location /api/ {
    client_max_body_size 8k;
    limit_req zone=patch_limit burst=5 nodelay;
    proxy_pass http://backend;
}