CVE-2026-67217 in cJSON
Summary
by MITRE • 07/29/2026
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in cJSON versions through 1.7.19 represents a critical flaw in JSON patch operation handling that violates fundamental security principles of atomicity and data integrity. This issue exists within the apply_patch() function located in cJSON_Utils.c where RFC 6902 JSON Patch operations are processed non-atomically, creating a dangerous scenario where partial modifications can occur before validation completes. The flaw manifests specifically during replace operations missing their value member or move operations with unresolved destination paths, where the system detaches and deletes existing target members before performing full validation checks.
This vulnerability directly impacts the atomic nature of JSON patch operations, which should follow an all-or-nothing approach as defined by industry standards such as CWE-665, which addresses improper initialization of resources. The implementation fails to maintain document consistency during patch processing, allowing attackers to manipulate data structures even when the API reports failure status. The security implications are severe because callers of these functions rely on atomic behavior to ensure that bad patches are completely rejected without causing partial mutations to target documents.
The operational impact extends beyond simple data corruption, as it creates a potential attack vector where malicious actors can selectively destroy addressable members of target documents while maintaining the illusion that patch operations failed. This behavior defeats the expected security model and can lead to data loss, information disclosure, or system instability depending on how the patched JSON documents are used. The vulnerability affects applications that process external JSON patch data, particularly those in web services, APIs, or any system where user-supplied patch operations are accepted without proper validation of their atomic nature.
Mitigation strategies must address both immediate and long-term security concerns for affected systems. The most direct solution involves upgrading to cJSON versions beyond 1.7.19 where the atomicity issue has been resolved. Organizations should also implement additional validation layers that verify patch operation integrity before applying changes, though this requires careful consideration of performance impacts. Security teams must review all applications utilizing cJSON for JSON patch processing and assess whether the vulnerability could be exploited through user input channels. The ATT&CK framework categorizes this as a privilege escalation technique through data manipulation, where attackers exploit implementation flaws to gain unauthorized control over system resources. Additionally, implementing proper input sanitization and validation mechanisms can help prevent exploitation while waiting for official patches to be deployed across affected systems.