CVE-2026-67217: Incorrect Behavior Order in DaveGamble cJSON
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.
AI Analysis
Technical Summary
The vulnerability in cJSON through version 1.7.19 involves the apply_patch() function in cJSON_Utils.c, which applies JSON Patch operations non-atomically. When a replace operation lacks its required value member, or a move operation's destination path cannot be resolved, the target member is detached and deleted before the patch operation is fully validated. As a result, even though the patch application function returns a failure status, the target JSON document is left in a mutated state. This allows an attacker who can supply patch documents to cause unintended destruction of addressable members in the target JSON, violating the expected atomicity and integrity of patch operations.
Potential Impact
An attacker able to supply JSON Patch documents can cause partial and unintended modification or deletion of members in the target JSON document, even when the patch operation fails. This undermines the atomicity guarantees of the patch API, potentially leading to data corruption or loss in applications relying on cJSON for JSON patching.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor vendor communications for updates and consider avoiding use of the affected patch functions with untrusted input until a fix is released.
CVE-2026-67217: Incorrect Behavior Order in DaveGamble cJSON
Description
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.
CVSS v4.0
Score 6.9medium
Affected software
DaveGamble
cJSON
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in cJSON through version 1.7.19 involves the apply_patch() function in cJSON_Utils.c, which applies JSON Patch operations non-atomically. When a replace operation lacks its required value member, or a move operation's destination path cannot be resolved, the target member is detached and deleted before the patch operation is fully validated. As a result, even though the patch application function returns a failure status, the target JSON document is left in a mutated state. This allows an attacker who can supply patch documents to cause unintended destruction of addressable members in the target JSON, violating the expected atomicity and integrity of patch operations.
Potential Impact
An attacker able to supply JSON Patch documents can cause partial and unintended modification or deletion of members in the target JSON document, even when the patch operation fails. This undermines the atomicity guarantees of the patch API, potentially leading to data corruption or loss in applications relying on cJSON for JSON patching.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor vendor communications for updates and consider avoiding use of the affected patch functions with untrusted input until a fix is released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-28T19:20:19.157Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a6a093d9c2644c7f89a31cf
Added to database: 07/29/2026, 14:07:57 UTC
Last enriched: 08/05/2026, 14:52:12 UTC
Last updated: 09/12/2026, 10:01:32 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.