Threat Intelligence Database

CVE-2026-86512 is a medium severity vulnerability in the java-json-tools json-patch library up to version 1.13. It involves improper access controls in the CopyOperation.apply and MoveOperation.apply functions, which could be exploited remotely. The vulnerability allows unauthorized manipulation due to insufficient access control enforcement. Although an exploit is publicly available, there is no vendor response or patch at this time.

CVE-2026-86512 is a medium severity vulnerability in the java-json-tools json-patch library up to version 1.13. It involves improper access controls in the CopyOperation.apply and MoveOperation.apply functions. The flaw allows remote exploitation without user interaction or privileges beyond low-level access. The vulnerability has a CVSS 4.0 base score of 5.3. The project has been informed but has not yet responded or issued a fix. Exploit code is publicly available.

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-86318 is a stack-based buffer overflow vulnerability in the java-json-tools json-patch library, specifically in the JsonMergePatch.fromJson function within JsonMergePatchDeserializer.java. This flaw affects all versions up to and including 1.13. The vulnerability can be exploited remotely without authentication and requires no user interaction. An exploit has been published, but there is no vendor response or patch available yet. The CVSS 4.0 base score is 6.9, indicating a medium severity.