CVE-2026-67217

NameCVE-2026-67217
DescriptioncJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1143048

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cjson (PTS)bullseye1.7.14-1+deb11u1vulnerable
bullseye (security)1.7.14-1+deb11u3vulnerable
bookworm, bookworm (security)1.7.15-1+deb12u4vulnerable
trixie, trixie (security)1.7.18-3.1+deb13u1vulnerable
forky, sid1.7.19-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cjsonsource(unstable)(unfixed)1143048

Notes

https://joshua.hu/cjson-json-parser-cve-vulnerabilities

Search for package or bug name: Reporting problems