Source: cjson Version: 1.7.19-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for cjson. CVE-2026-67215[0]: | cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading | to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied | via cJSONUtils_ApplyPatches() or | cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and | copy operations grafts duplicated subtrees to amplify document depth | beyond the parser's nesting limit: cJSON_Delete() recurses with no | depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is | set to 10000, ten times the parser's 1000-level nesting limit and | high enough to overflow a default thread stack. An attacker who can | supply the patch document can crash the process, resulting in denial | of service. CVE-2026-67216[1]: | cJSON through 1.7.19 contains an inefficient algorithmic complexity | flaw in cJSON_Compare(). When comparing objects, the function | recurses into each shared subtree twice, once in each direction, | with no depth guard, making the running time exponential in nesting | depth. A small, deeply nested document of a few hundred bytes (depth | around 40) compared for equality consumes hours of CPU, and the cost | roughly doubles with each additional level of nesting. An | application that calls cJSON_Compare() on attacker-influenced JSON | that is structurally equal to a reference document is exposed to a | denial-of-service condition. CVE-2026-67217[2]: | cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non- | atomically in apply_patch() in cJSON_Utils.c. For a replace | operation that is missing its value member, or a move operation | whose destination path cannot be resolved, the existing target | member is detached and deleted before the operation is fully | validated, so the target document is mutated while | cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() | returns a failure status. An attacker who can supply the patch | document can destroy addressable members of the target document even | though the API reports that the patch failed, defeating the all-or- | nothing behavior callers rely on to reject bad patches. Those ar a subset of the 33 findings/reports of [3]. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-67215 https://www.cve.org/CVERecord?id=CVE-2026-67215 [1] https://security-tracker.debian.org/tracker/CVE-2026-67216 https://www.cve.org/CVERecord?id=CVE-2026-67216 [2] https://security-tracker.debian.org/tracker/CVE-2026-67217 https://www.cve.org/CVERecord?id=CVE-2026-67217 [3] https://joshua.hu/cjson-json-parser-cve-vulnerabilities Regards, Salvatore
