EUVD-2026-50329

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67216 cJSON cJSON_Compare Exponential Complexity Denial of Service

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-67216

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-67216 cJSON cJSON_Compare Exponential Complexity Denial of Service

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-67216

Summary of CVE-2026-67216 (cJSON) : Affected software is cJSON up to version 1.7.19. The flaw is in cJSON_Compare(), which recurses into shared subtrees twice without a depth guard, causing exponential time growth with nesting depth. A small, deeply nested JSON (depth ~40) can take hours to compa...

CVE-2026-67216 cJSON cJSON_Compare Exponential Complexity Denial of Service

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-67216

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-67215 cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

EUVD-2026-50327

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67215

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67215

The CVE-2026-67215 entry applies to cJSON 1.7.19 and earlier where applying an untrusted RFC 6902 JSON Patch via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() can cause uncontrolled recursion, leading to stack exhaustion and DoS. The patch’s add and copy operations may graft...

CVE-2026-67215 cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67215 cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67215

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67215

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

Linux Distros Unpatched Vulnerability : CVE-2026-67216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree...

CVE-2026-67215: Uncontrolled Recursion

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

Linux Distros Unpatched Vulnerability : CVE-2026-67215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via...

Linux Distros Unpatched Vulnerability : CVE-2026-67217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value...

CVE-2026-67216: Inefficient Algorithmic Complexity

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...