Description
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DaveGamble | cJSON | 1.5.0 – ≤ 1.7.19 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cjson | No fix yet | — |
| Debian 13 | cjson | No fix yet | — |
| Debian 12 | cjson | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | cjson | No fix yet | — |
| Ubuntu 26.04 LTS | cjson | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | cjson | No fix yet | — |
| Ubuntu Pro 22.04 LTS | cjson | No fix yet | — |
| Ubuntu Pro 20.04 LTS | cjson | No fix yet | — |
References
- Product Repository product
- https://www.vulncheck.com/advisories/cjson-wrong-key-modification-via-json-pointer-escape-decoding third-party-advisory