Executive brief
cJSON is a widely used library for parsing and manipulating JSON data in C-based applications and embedded firmware. A flaw in how the library handles 'JSON Patch' updates allows an attacker to provide a specially crafted file that causes the application to crash. This results in a denial of service, potentially disrupting operations or taking down services that rely on this library to process data.
Technical details
A vulnerability exists in cJSON through version 1.7.19 within the cJSONUtils_ApplyPatches() and cJSONUtils_ApplyPatchesCaseSensitive() functions. The issue stems from uncontrolled recursion during the processing of RFC 6902 JSON Patches containing 'add' and 'copy' operations. These operations can be used to graft duplicated subtrees, amplifying document depth beyond the parser's 1000-level nesting limit. Because cJSON_Delete() lacks recursion depth bounds and the cJSON_Duplicate() guard (CJSON_CIRCULAR_LIMIT) is set to 10,000—significantly higher than the parser's limit—an attacker can trigger a stack overflow. This results in a process crash (Denial of Service). No patch is currently available as development of the library is reportedly stagnant.
Affected products
- DaveGamble cJSON through 1.7.19
Timeline
- 2026-07-29: disclosed: Vulnerability published in NVD and by researcher Joshua Rogers.