# CVE-2026-67217: DaveGamble cJSON non-atomic JSON Patch application in cJSON_Utils.c

Source: https://junglewise.ai/threats/cve-2026-67217-davegamble-cjson-non-atomic-json-patch-application-in-cjson-utils  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-67217 · Severity: medium · CVSS 5.3 · Published 2026-07-29

cJSON is a widely used C library for parsing and manipulating JSON data, often found in embedded firmware and server-side applications. A flaw in its JSON Patch implementation allows an attacker to partially corrupt or delete data within a document even if the overall update operation is reported as a failure. This breaks the expected 'all-or-nothing' behavior of data updates, potentially leading to data loss or inconsistent application states.

Technologies: [DaveGamble cJSON](https://junglewise.ai/threats/technologies/cjson). Vendors: [DaveGamble](https://junglewise.ai/threats/vendors/davegamble).

## Quick answers

**Is CVE-2026-67217 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67217 being exploited in the wild.

**How severe is CVE-2026-67217?** Medium severity, with a CVSS score of 5.3, published 29 July 2026.

**Which products and versions are affected?** DaveGamble cJSON through 1.7.19.

**Is there a fix for CVE-2026-67217?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67217 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67217?** Check whether you run DaveGamble cJSON at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `apply_patch()` function within `cJSON_Utils.c`. When processing 'replace' or 'move' operations, the library detaches and deletes the target member before completing the validation of the operation (e.g., checking for a missing 'value' member or resolving a destination path). Because these operations are non-atomic, a malformed patch can cause permanent mutation of the target document despite `cJSONUtils_ApplyPatches()` returning a failure status. An attacker capable of providing a patch document can exploit this 'Incorrect Behavior Order' (CWE-696) to destroy addressable members of the target JSON structure. As of version 1.7.19, no official patch has been merged.

## Affected products

- DaveGamble cJSON through 1.7.19

## Timeline

- 2026-07-29: disclosed: Vulnerability details published by Joshua Rogers
- 2026-07-29: advisory: NVD and VulnCheck advisories published

## References

- [https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c](https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c)
- [https://joshua.hu/cjson-json-parser-cve-vulnerabilities](https://joshua.hu/cjson-json-parser-cve-vulnerabilities)
- [https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation](https://www.vulncheck.com/advisories/cjson-json-patch-non-atomic-application-destroys-data-before-validation)

## Related threats

- [cJSON use-after-free in MergePatch](https://junglewise.ai/threats/cve-2026-87933-cjson-use-after-free-in-mergepatch)
- [cJSON JSON Pointer escape sequence bypass in decode_pointer_inplace()](https://junglewise.ai/threats/cve-2026-29036-cjson-json-pointer-escape-sequence-bypass-in-decode-pointer)
- [DaveGamble cJSON denial of service in cJSON_Compare](https://junglewise.ai/threats/cve-2026-67216-davegamble-cjson-denial-of-service-in-cjson-compare)
- [DaveGamble cJSON uncontrolled recursion in cJSONUtils_ApplyPatches](https://junglewise.ai/threats/cve-2026-67215-davegamble-cjson-uncontrolled-recursion-in-cjsonutils)
- [DaveGamble cJSON integer overflow in print_string_ptr](https://junglewise.ai/threats/cve-2026-16554-davegamble-cjson-integer-overflow-in-print-string-ptr)