CVE-2026-67217: cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch() in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtilsApplyPatches() or cJSONUtilsApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cJSONto a version that resolves this vulnerability.Fixed in 1.7.19 - Compensating control
Because cJSON applies RFC 6902 JSON Patch operations non-atomically and may mutate the target document before validation fails, do not rely on the API failure status to preserve the original document; apply JSON patches only after pre-validating patch documents/operations (e.g., ensure replace operations include a value member and move destinations can be resolved) and use an application-level all-or-nothing workflow (such as patching a copy and committing only on success).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67217?
CVE-2026-67217 has a medium severity rating of 5.3.
How does CVE-2026-67217 affect data?
CVE-2026-67217 allows non-atomic application of JSON patch operations, potentially leading to data loss.
What software is impacted by CVE-2026-67217?
CVE-2026-67217 affects the cJSON JSON Patch library versions up to 1.7.19.
How can I mitigate CVE-2026-67217?
Mitigation for CVE-2026-67217 involves upgrading to a patched version of the cJSON library.
What types of operations are affected by CVE-2026-67217?
CVE-2026-67217 specifically affects replace and move operations in JSON patch applications when certain conditions are unmet.