CVE-2026-86319: java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments using java-json-tools json-patch through version 1.13 are affected if an attacker can cause the application to invoke JsonPatch.apply with attacker-controlled input. The issue can be initiated remotely and requires no privileges or user interaction according to the supplied vector.
What is the practical impact of exploitation?
Successful exploitation causes resource consumption, resulting in an availability impact. The supplied severity vector indicates no confidentiality or integrity impact.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
Is a vendor fix available?
The provided information does not identify a fix. It states that the project was notified early through an issue report but had not responded at the time of disclosure.