Executive brief
java-json-tools json-patch is a Java library that implements JSON Patch and JSON Merge Patch standards. A flaw in the JsonMergePatch deserialization allows attackers to send deeply nested JSON objects that cause the application to crash with a StackOverflowError, disrupting service availability. This requires no authentication and can be exploited with a single malicious HTTP request.
Technical details
The vulnerability is an uncontrolled recursion flaw in JsonMergePatchDeserializer.deserialize() (CWE-674). When processing nested JSON objects, the deserializer recursively calls itself without any depth limit. An attacker can craft a JSON structure with 2000+ nesting levels to trigger a StackOverflowError that kills the processing thread and cannot be reliably caught. The attack vector is network-based (remote) with no authentication or user interaction required. The flaw exists regardless of Jackson's own parsing depth protections, because it affects json-patch's custom deserialization logic applied to already-parsed JsonNode objects. The project has not yet released a patch.
Affected products
- java-json-tools json-patch up to 1.13
Timeline
- 2026-07-29: disclosed: Security issue reported on GitHub
- 2026-09-07: other: CVE-2026-86318 published