CVE-2026-86319 in json-patch
Summary
by MITRE • 09/07/2026
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in java-json-tools json-patch versions up to 1.13 represents a significant risk related to resource consumption, specifically targeting the JsonPatch.apply function located within the Patch Operation Handler component at src/main/java/com/github/fge/jsonpatch/JsonPatch.java. This flaw allows an attacker to trigger excessive processing or memory allocation through malformed input, leading to a denial of service condition where the affected system becomes unresponsive or crashes due to exhaustion of computational resources. The nature of this vulnerability aligns with CWE-400, which describes conditions where a software product does not properly control the allocation and maintenance of a limited resource, thereby enabling an attacker to disrupt availability by consuming those resources beyond acceptable limits.
From an operational perspective, because the JsonPatch.apply method is often used in web applications that process JSON Patch documents as part of RESTful API interactions or data synchronization processes, this vulnerability can be exploited remotely without requiring authentication if the endpoint accepting patch operations is publicly accessible. An attacker can craft a specifically designed JSON Patch document containing deeply nested structures, excessively large arrays, or recursive references that cause the parser to enter an infinite loop or allocate memory exponentially until system limits are reached. This capability makes it particularly dangerous in high-throughput environments where such patches are processed frequently and automatically, as even small-scale attacks from multiple sources could collectively overwhelm server capacity.
The fact that this exploit has been disclosed publicly means that automated scanning tools and malicious actors can readily identify vulnerable instances on the internet. The lack of a response from the project maintainers despite early notification via issue reports exacerbates the risk, leaving users with no official patch or update to mitigate the flaw within the affected version range. This situation highlights the importance of monitoring upstream projects for security advisories and being prepared to implement workarounds when vendor support is delayed or absent.
To mitigate this vulnerability in the absence of an immediate software update, organizations should consider implementing strict input validation and size limits on JSON Patch documents before they are passed to the JsonPatch.apply method. This can include enforcing maximum depth for nested objects, limiting array sizes, and setting timeouts on parsing operations to prevent indefinite execution. Additionally, deploying a Web Application Firewall with rules capable of detecting anomalous patterns in JSON payloads or rate-limiting requests that involve patch operations can help absorb potential attacks. Upgrading to a newer version of the library once it becomes available is the most effective long-term solution, but until then, defensive coding practices and network-level controls are essential to maintain service availability and protect against resource exhaustion attacks associated with CWE-400 and techniques often categorized under ATT&CK T1499 Endpoint Denial of Service.