CVE-2026-86319
MediumCVSS 5.3Summary
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
The risk is the possibility of exhausting system resources (CPU, memory), which could lead to denial of service (DoS) and disruption of application operation.
Recommendation
It is recommended to restrict access to the JsonPatch.apply function, introduce limits on the size and complexity of patch operations, and monitor resource usage.
Other vulnerabilities in json-patch
See all- CVE-2026-86512Medium
A vulnerability in java-json-tools json-patch up to 1.13 affects the CopyOperation.apply/MoveOperation.apply functions in src/main/java/com/github/fge/jsonpatch/CopyOperation.java in the Copy Move Operations component. Manipulation leads to improper access controls. Remote exploitation is possible, and the exploit is publicly available. The project has not responded to the issue report.
- CVE-2026-86318Medium
A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchDeserializer.java. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.