Listen to this Post
How CVE-2026-67215 Works
cJSON is a widely used single-file JSON parser written in C, vendored into countless embedded firmwares, IoT devices, server-side applications, and even ESP-IDF. Versions through 1.7.19 contain a critical uncontrolled recursion vulnerability (CWE-674) that manifests when processing untrusted RFC 6902 JSON Patch documents via `cJSONUtils_ApplyPatches()` or its case‑sensitive variant.
The root cause lies in how the library handles `add` and `copy` operations within a JSON Patch. An attacker can craft a patch that grafts duplicated subtrees onto the target document, exponentially amplifying its structural depth. The parser enforces a nesting limit of 1000 levels during initial parsing — a reasonable guard against deep JSON documents. However, the `cJSONUtils_ApplyPatches()` function does not re‑validate depth after applying patch operations. It blindly trusts the patched document’s structure.
When `cJSON_Delete()` is later called to free the patched document, it recurses through every node with no depth bound. The recursion traverses the entire tree, following child and sibling pointers until it reaches the artificially inflated depth. This unbounded recursion quickly consumes the thread’s stack space.
Compounding the issue, `cJSON_Duplicate()` — used internally during `copy` operations — has a circular reference guard called `CJSON_CIRCULAR_LIMIT` set to 10,000. This value is ten times higher than the parser’s 1000‑level nesting limit and is large enough to overflow a default thread stack (typically 8 MB on Linux) before the guard ever triggers. The 10,000 limit was intended to prevent infinite loops from circular references, not to protect against deep tree duplication.
An attacker who can supply a malicious patch document — for example, via a WebSocket frame, HTTP request body, or any API that accepts JSON Patch — can force the process to crash with a segmentation fault (SIGSEGV) when the stack pointer hits the guard page. This results in a denial‑of‑service condition. No memory corruption or code execution occurs, but the crash terminates all calls and sessions on the host, making it a high‑severity availability issue with a CVSS 3.1 base score of 7.5.
DailyCVE Form:
Platform: cJSON library
Version: 1.7.19 and earlier
Vulnerability: Uncontrolled recursion stack exhaustion
Severity: HIGH (CVSS 7.5)
Date: 2026-07-29
Prediction: 2026-08-15 (vendor patch expected)
What Undercode Say
Analytics:
The vulnerability affects all deployments that use cJSONUtils_ApplyPatches() on untrusted input. Attack vectors include WebSocket APIs, REST endpoints accepting JSON Patch (RFC 6902), and any service that applies patches to internal JSON state. The exploit requires no authentication and can be triggered with a single crafted frame. Successful exploitation causes immediate process termination, impacting availability of the entire service. The vulnerability is particularly critical in telephony platforms (FreeSWITCH), embedded systems, and cloud-native microservices that rely on cJSON for configuration management.
Bash Commands & Codes:
Check installed cJSON version on Debian/Ubuntu dpkg -l | grep libcjson Check on RHEL/CentOS/Fedora rpm -qa | grep cjson Verify version in source code grep -r "cJSON_Version" /usr/include/cJSON.h Check if CJSON_CIRCULAR_LIMIT is set to unsafe default (10000) grep -r "CJSON_CIRCULAR_LIMIT" /usr/include/cJSON.h
Proof‑of‑Concept snippet (JSON Patch payload):
[
{ "op": "add", "path": "/a", "value": { "b": {} } },
{ "op": "copy", "from": "/a", "path": "/c" },
{ "op": "copy", "from": "/c", "path": "/d" },
{ "op": "copy", "from": "/d", "path": "/e" }
/ Repeat copy operations to exceed 1000 depth /
]
Detection script (Python):
import json
patch = []
Build a patch that recursively copies to amplify depth
for i in range(1500):
patch.append({"op": "copy", "from": "/a", "path": f"/level_{i}"})
print(json.dumps(patch))
Exploit
An unauthenticated attacker sends a JSON Patch document containing a sequence of `add` followed by multiple `copy` operations that graft duplicated subtrees onto the target. Each `copy` duplicates the subtree rooted at /a, doubling the number of nodes at each step. After approximately 10–12 copy operations, the document depth exceeds 1000 levels. The parser accepts the patch because the initial parsing depth check passed. When `cJSON_Delete()` is invoked to free the patched tree, it recurses without bound, exhausting the thread stack and crashing the process. No special privileges or prior knowledge of the target is required.
Protection
- Upgrade cJSON to version 1.7.20 or later once released. The fix caps recursion depth in `cJSON_Duplicate()` and `cJSON_Delete()` to match the parser’s 1000‑level limit.
- Apply vendor patches: openSUSE-SU-2026:20340‑1 addresses this issue. For Ubuntu, use USN‑7973‑1.
- Reduce `CJSON_CIRCULAR_LIMIT` at compile time to a value no higher than `CJSON_NESTING_LIMIT` (1000) to prevent deep duplication.
- Validate and sanitize all JSON Patch inputs before passing them to cJSON utilities. Reject patches that contain excessive `copy` operations or attempt to create deeply nested structures.
- Use stack protection compiler flags (
-fstack-protector-strong) and increase thread stack size only as a temporary mitigation — this does not fix the root cause.
Impact
- Confidentiality: None. The vulnerability does not leak data.
- Integrity: None. No data is modified or corrupted.
- Availability: High. Successful exploitation crashes the process, terminating all active sessions and calls. In telephony platforms like FreeSWITCH, this drops all ongoing calls. In embedded systems, a crash may trigger a watchdog reset, causing device reboot and service downtime.
- Scope: Unchanged. The attack does not spread to other system components.
- Exploitability: Remotely exploitable over any network protocol that accepts JSON Patch input. No authentication required. Low attack complexity.
- CVSS 3.1 Base Score: 7.5 (HIGH) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
