Description
A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-07
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the JsonPatch.apply method of the java‑json‑tools json‑patch library. Maliciously constructing a patch document can trigger excessive allocation of memory or CPU cycles, leading to a denial of service. This is a classic resource exhaustion situation identified as CWE‑400 and CWE‑404. Attackers can achieve this merely by sending a crafted patch to any component that uses the library, potentially causing application slowdown or crash. The vulnerability is listed with a CVSS score of 6.9, moderate severity.

Affected Systems

The library is affected up to version 1.13, including all 1.13.x releases. It is compatible with all Java environments that include java‑json‑tools json‑patch. Any application, microservice, or API that directly or indirectly processes JSON patch requests using this library is vulnerable. The product is a pure Java library available via Maven, Gradle, or GitHub, used in numerous projects across Java ecosystems.

Risk and Exploitability

The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not yet listed in CISA's KEV catalog, suggesting no documented widespread exploitation yet. Nevertheless, the vulnerability can be triggered remotely through any exposed endpoint that accepts JSON patch payloads. An attacker could upload an oversized or complex patch document, forcing the application to consume excessive resources, potentially leading to service degradation or denial of service for legitimate users.

Generated by OpenCVE AI on September 7, 2026 at 17:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Implement input validation to reject JSON patch documents that exceed safe size or complexity thresholds before invoking JsonPatch.apply.
  • Wrap the JsonPatch.apply call in a resource‑limited context such as a thread pool with timeouts and memory caps to prevent runaway consumption.
  • Ensure the application is updated to a later version of json‑patch if and when the maintainers release a fixed release, and monitor the library’s issue tracker for additional mitigation guidance.

Generated by OpenCVE AI on September 7, 2026 at 17:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption
First Time appeared Java-json-tools
Java-json-tools json-patch
Weaknesses CWE-400
CWE-404
CPEs cpe:2.3:a:java-json-tools:json-patch:*:*:*:*:*:*:*:*
Vendors & Products Java-json-tools
Java-json-tools json-patch
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Java-json-tools Json-patch
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-07T14:45:07.734Z

Reserved: 2026-09-07T05:33:02.820Z

Link: CVE-2026-86319

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T15:17:34.250

Modified: 2026-09-07T15:17:34.250

Link: CVE-2026-86319

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T19:00:11Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-404

    Improper Resource Shutdown or Release