Is CVE-2026-86319 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86319 being exploited in the wild.

How severe is CVE-2026-86319?

Medium severity, with a CVSS score of 5.3, published 7 September 2026.

Which products and versions are affected?

java-json-tools json-patch up to 1.13.

Is there a fix for CVE-2026-86319?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86319 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86319?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86319: java-json-tools json-patch denial of service in JsonPatch.apply()

CVE-2026-86319 · Severity: medium · CVSS 5.3 · Published 2026-09-07

json-patch is a Java library that processes JSON Patch documents (RFC 6902) to modify JSON data structures. The library fails to limit the number of operations in a patch request, allowing an attacker to send a request with tens of thousands of operations that consume excessive CPU and memory, blocking the server for extended periods and potentially causing a denial of service.

Quick answers

Is CVE-2026-86319 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86319 being exploited in the wild.
How severe is CVE-2026-86319?: Medium severity, with a CVSS score of 5.3, published 7 September 2026.
Which products and versions are affected?: java-json-tools json-patch up to 1.13.
Is there a fix for CVE-2026-86319?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86319 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86319?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an uncontrolled resource consumption (CWE-400) in the JsonPatch.apply() method, which processes patch operations without enforcing any limit on operation count, timeout, or resource budget. Each patch operation internally calls node.deepCopy(), resulting in O(N×M) complexity where N is the number of operations and M is the document size. An unauthenticated, network-based attacker can exploit this by sending a malicious JSON Patch document containing tens of thousands of operations; proof-of-concept testing shows 50,000 operations consuming 68+ seconds of CPU and quadratic memory growth. The vulnerability affects json-patch up to and including version 1.13, and the maintainers have not yet responded to the initial report.

Affected products

java-json-tools json-patch up to 1.13

Timeline

2026-07-29: disclosed: Security issue #167 reported on GitHub
2026-09-07: advisory: CVE-2026-86319 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.