CVE-2026-86319: Resource Consumption in java-json-tools json-patch

This vulnerability in java-json-tools json-patch (up to version 1.13) involves the JsonPatch.apply function in the Patch Operation Handler component. An attacker can remotely trigger excessive resource consumption by manipulating inputs to this function. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No official patch or mitigation has been published, and no known exploits are currently active in the wild.

Successful exploitation can cause resource consumption on the affected system, potentially leading to denial of service or degraded performance. The vulnerability can be triggered remotely without authentication or user interaction, increasing its risk profile. However, no active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official sources for updates. In the meantime, consider limiting exposure of services using this library and applying any available runtime resource controls to mitigate potential impact.