CVE-2026-67217

The record

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.

Affected packages

Related vulnerabilities

• CVE-2026-59305 Partition interceptor may be improperly added while sending message. CWE-696
• CVE-2026-68930 Russh is a Rust SSH client & server library. CWE-696
• CVE-2026-56355 GNU Savannah Administration Savane through 3.17 uses untrusted data as part of… CWE-696
• CVE-2026-49317 Incorrect behavior order in the Infotainment / Digital Round display of the Indian… CWE-696
• CVE-2026-49318 Incorrect behavior order in the Infotainment / Digital Round display of the Indian… CWE-696
• CVE-2026-44919 In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop… CWE-696
• CVE-2026-45033 GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. CWE-696
• GHSA-9ccr-r5hg-74gf GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via… CWE-696