CVE-2026-86319
java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-400 CWE-404 |
| Vendor | java-json-tools |
| Product | json-patch |
| Published | Sep 7, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for java-json-tools json-patch
Be the first to know when new medium vulnerabilities affecting java-json-tools json-patch are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
java-json-tools / json-patch
1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13
References
vuldb.com: https://vuldb.com/vuln/399510 vuldb.com: https://vuldb.com/vuln/399510/cti vuldb.com: https://vuldb.com/cve/CVE-2026-86319 vuldb.com: https://vuldb.com/submit/908321 github.com: https://github.com/java-json-tools/json-patch/issues/167 github.com: https://github.com/java-json-tools/json-patch/
Credits
🔍 York Shen - Yong Shen - PayPal Cyber Security Team (VulDB User) VulDB CNA Team