Is CVE-2026-29036 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29036 being exploited in the wild.

How severe is CVE-2026-29036?

High severity, with a CVSS score of 7.5, published 11 August 2026.

Which products and versions are affected?

DaveGamble cJSON 1.5.0 through 1.7.19.

Is there a fix for CVE-2026-29036?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-29036 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-29036?

Check whether you run DaveGamble cJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29036: cJSON JSON Pointer escape sequence bypass in decode_pointer_inplace()

CVE-2026-29036 · Severity: high · CVSS 7.5 · Published 2026-08-11

cJSON is a lightweight JSON parsing library used in many applications to process JSON data. The library contains a flaw in how it handles JSON Patch operations that use special escape sequences, allowing attackers to cause patches to modify incorrect object keys or delete unintended data. This could enable attackers to corrupt application data or bypass access controls in systems that rely on JSON Patch for data modifications.

Technologies: DaveGamble cJSON. Vendors: DaveGamble.

Quick answers

Is CVE-2026-29036 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29036 being exploited in the wild.
How severe is CVE-2026-29036?: High severity, with a CVSS score of 7.5, published 11 August 2026.
Which products and versions are affected?: DaveGamble cJSON 1.5.0 through 1.7.19.
Is there a fix for CVE-2026-29036?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-29036 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-29036?: Check whether you run DaveGamble cJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrectly-resolved name or reference flaw (CWE-706) in the decode_pointer_inplace() function within cJSON_Utils.c. The function fails to properly decode JSON Pointer escape sequences (~0 and ~1) according to RFC 6902, allowing attackers to craft malicious JSON Patch input that targets wrong object keys. The flaw affects the cJSONUtils_ApplyPatches() and cJSONUtils_ApplyPatchesCaseSensitive() functions, which process RFC 6902 JSON Patch operations. Unauthenticated network attackers can exploit this by submitting crafted escape sequences in patch paths to silently corrupt data, delete unintended keys, or bypass authorization controls. Versions 1.5.0 through 1.7.19 are affected; patches should be available in later releases.

Affected products

DaveGamble cJSON 1.5.0 through 1.7.19

Timeline

2026-08-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.