Is CVE-2026-86318 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86318 being exploited in the wild.

How severe is CVE-2026-86318?

Medium severity, with a CVSS score of 5.3, published 7 September 2026.

Which products and versions are affected?

java-json-tools json-patch up to 1.13.

Is there a fix for CVE-2026-86318?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86318 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86318?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86318: java-json-tools json-patch stack overflow in merge patch deserialization

CVE-2026-86318 · Severity: medium · CVSS 5.3 · Published 2026-09-07

java-json-tools json-patch is a Java library that implements JSON Patch and JSON Merge Patch standards. A flaw in the JsonMergePatch deserialization allows attackers to send deeply nested JSON objects that cause the application to crash with a StackOverflowError, disrupting service availability. This requires no authentication and can be exploited with a single malicious HTTP request.

Quick answers

Is CVE-2026-86318 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86318 being exploited in the wild.
How severe is CVE-2026-86318?: Medium severity, with a CVSS score of 5.3, published 7 September 2026.
Which products and versions are affected?: java-json-tools json-patch up to 1.13.
Is there a fix for CVE-2026-86318?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86318 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86318?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an uncontrolled recursion flaw in JsonMergePatchDeserializer.deserialize() (CWE-674). When processing nested JSON objects, the deserializer recursively calls itself without any depth limit. An attacker can craft a JSON structure with 2000+ nesting levels to trigger a StackOverflowError that kills the processing thread and cannot be reliably caught. The attack vector is network-based (remote) with no authentication or user interaction required. The flaw exists regardless of Jackson's own parsing depth protections, because it affects json-patch's custom deserialization logic applied to already-parsed JsonNode objects. The project has not yet released a patch.

Affected products

java-json-tools json-patch up to 1.13

Timeline

2026-07-29: disclosed: Security issue reported on GitHub
2026-09-07: other: CVE-2026-86318 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.