CVE-2026-86318 in json-patch
Summary
by MITRE • 09/07/2026
A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchDeserializer.java. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in java-json-tools json-patch versions up to 1.13 represents a critical security flaw within the JsonMergePatch.fromJson function located in the JsonMergePatchDeserializer.java file. This defect is classified as a stack-based buffer overflow, which occurs when a program writes more data to a fixed-length block of memory on the call stack than it can hold. In this specific context, the deserialization process fails to adequately validate or bound-check the input size relative to the allocated buffer space before copying data into it. This lack of proper boundary checking allows an attacker who supplies a specifically crafted JSON payload with excessive nesting depth or oversized string values to overwrite adjacent memory locations on the stack. Such overwrites can corrupt critical execution context information, including return addresses and saved frame pointers, thereby altering the normal flow of program control.
From a technical perspective, this flaw aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write on Stack. The vulnerability is particularly dangerous because it resides within a widely used library for handling JSON Patch operations in Java applications, which are prevalent across many enterprise systems. When the JsonMergePatch.fromJson method processes untrusted input from an external source, such as HTTP requests or message queues, it directly feeds this data into internal buffers without sufficient validation. If the input exceeds the expected limits, the resulting stack corruption can lead to application crashes, denial of service conditions, or potentially arbitrary code execution if the attacker successfully overwrites a function pointer with shellcode addresses. The presence of published exploits indicates that the attack vector is well-understood and easily replicable by malicious actors seeking to compromise systems relying on this library version.
The operational impact of this vulnerability extends beyond simple application instability. Because the flaw can be triggered remotely, it significantly expands the attack surface for any service exposing JSON Patch endpoints without proper input sanitization or rate limiting. An attacker could leverage this buffer overflow to achieve remote code execution (RCE), gaining full control over the underlying operating system and potentially pivoting to other parts of the network. This aligns with MITRE ATT&CK techniques related to Initial Exploitation, specifically T1190 Exploit Public-Facing Application and T1203 Exploitation for Client Execution if the overflow leads to downloading further malware payloads. The severity is compounded by the fact that the project maintainers have not yet responded to early issue reports, leaving users of affected versions exposed without an official patch or mitigation guidance from the upstream source.
To mitigate this risk, organizations must immediately assess their dependency trees for any usage of json-patch libraries version 1.13 and below. The primary remediation strategy is to upgrade to a patched version where the JsonMergePatchDeserializer.java has been updated with strict input validation checks that enforce length limits on incoming JSON structures before deserialization occurs. If upgrading is not immediately feasible, temporary mitigations should include implementing robust input filtering at the network perimeter or application gateway level to reject payloads containing excessively deep nesting or unusually large string fields characteristic of buffer overflow attempts. Additionally, enabling stack protection mechanisms such as Stack Canaries and Address Space Layout Randomization (ASLR) can help detect exploitation attempts and reduce the likelihood of successful code execution by randomizing memory layouts. Continuous monitoring for anomalous behavior in services utilizing this library is also recommended to identify potential exploitation activities in real-time.