CVE-2026-67215

HIGH 7.5

cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser's 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service.

CWE	CWE-674
Vendor	davegamble
Product	cjson
Published	Jul 29, 2026

Stay Ahead of the Next One

Get instant alerts for davegamble cjson

Be the first to know when new high vulnerabilities affecting davegamble cjson are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

DaveGamble / cJSON

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

joshua.hu: https://joshua.hu/cjson-json-parser-cve-vulnerabilities github.com: https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON.c#L253-L261 github.com: https://github.com/DaveGamble/cJSON/blob/v1.7.19/cJSON_Utils.c#L906-L940 vulncheck.com: https://www.vulncheck.com/advisories/cjson-json-patch-copy-add-uncontrolled-recursion-stack-exhaustion