Executive brief
json-patch is a Java library that processes JSON Patch documents (RFC 6902) to modify JSON data structures. The library fails to limit the number of operations in a patch request, allowing an attacker to send a request with tens of thousands of operations that consume excessive CPU and memory, blocking the server for extended periods and potentially causing a denial of service.
Technical details
The vulnerability is an uncontrolled resource consumption (CWE-400) in the JsonPatch.apply() method, which processes patch operations without enforcing any limit on operation count, timeout, or resource budget. Each patch operation internally calls node.deepCopy(), resulting in O(N×M) complexity where N is the number of operations and M is the document size. An unauthenticated, network-based attacker can exploit this by sending a malicious JSON Patch document containing tens of thousands of operations; proof-of-concept testing shows 50,000 operations consuming 68+ seconds of CPU and quadratic memory growth. The vulnerability affects json-patch up to and including version 1.13, and the maintainers have not yet responded to the initial report.
Affected products
- java-json-tools json-patch up to 1.13
Timeline
- 2026-07-29: disclosed: Security issue #167 reported on GitHub
- 2026-09-07: advisory: CVE-2026-86319 published