This vulnerability in the json-patch component of java-json-tools affects the JsonPatch.apply function in the Patch Operation Handler. It causes excessive resource consumption, which can be triggered remotely without privileges or user interaction. The vulnerability impacts all versions from 1.0 through 1.13 inclusive. The project was notified early but has not issued a patch or official remediation. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector and lack of required privileges or user interaction. Exploit details have been publicly disclosed.

Successful exploitation leads to resource consumption on the affected system, potentially causing denial of service or degraded performance. No direct data confidentiality, integrity, or availability impacts beyond resource exhaustion are described. The vulnerability can be exploited remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published and the vendor has not responded, users should monitor the project for updates. Until a patch is available, consider limiting exposure of the vulnerable component to untrusted networks or applying resource usage limits if feasible.