CVE-2026-29036

A flaw was found in cJSON, a JSON parser and generator. This vulnerability allows unauthenticated attackers to manipulate JSON Patch operations by supplying crafted JSON Pointer escape sequences. This can lead to silent corruption of data or the deletion of unintended keys, potentially bypassing...

EUVD-2026-57008

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-29036

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

UBUNTU-CVE-2026-29036

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-29036 cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-29036

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-29036

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-29036 cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

PT-2026-70929

Name of the Vulnerable Software and Affected Versions cJSON versions 1.5.0 through 1.7.19 Description An incorrectly-resolved name or reference issue exists in the decode pointer inplace function within cJSON Utils.c. Unauthenticated attackers can cause JSON Patch operations to target incorrect...

CVE-2026-67215

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67217

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

EUVD-2026-50329

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67215 cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67215 cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67215 cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67215

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...