CVE-2026-67215

cJSON through version 1.7.19, DaveGamble's widely embedded open-source C JSON library, is vulnerable to uncontrolled recursion (CWE-674) that causes stack exhaustion and a process crash when an untrusted RFC 6902 JSON Patch document is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). The flaw arises because add and copy operations in a crafted patch graft duplicated subtrees, driving document depth far beyond the parser's 1000-level nesting limit, while cJSON_Delete() recurses with no depth bound and cJSON_Duplicate()'s CJSON_CIRCULAR_LIMIT guard of 10000 permits trees deep enough to overflow a default thread stack. An attacker who can supply the patch document gains denial of service only: the CVSS 4.0 base of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects high availability impact with no confidentiality or integrity loss. Any application, daemon, or embedded product that links or vendors cJSON up to 1.7.19 and applies attacker-controlled JSON Patch documents is affected; the CVE record lists only the davegamble/cjson product itself, so downstream consumers must be identified through dependency auditing. There is no confirmed in-the-wild exploitation (absent from CISA KEV, EPSS about 0.5%), but one public analysis with a proof-of-concept is available.

What to do: Audit dependencies and vendored source trees for cJSON (forked copies are common given its single-file MIT distribution) and determine whether cJSONUtils_ApplyPatches()/cJSONUtils_ApplyPatchesCaseSensitive() ever processes untrusted input; no fixed release is stated in the available data, so track the upstream DaveGamble/cJSON repository for a patched version beyond 1.7.19 and upgrade when one is published. As an interim mitigation, cap patch document depth and operation counts well below the parser's 1000-level nesting limit before applying patches, and/or run JSON Patch processing in an isolated worker process so a stack-overflow crash does not take down the host service.