Description

A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchDeserializer.java. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T15:17:34.040Z",
  "pubdate": "2026-09-07T15:17:34.040Z",
  "executiveSummary": "A critical vulnerability exists in the java-json-tools json-patch library, specifically within the JsonMergePatch.fromJson function. This flaw allows for a stack-based buffer overflow, potentially enabling remote code execution or application crashes.\nThe vulnerability affects versions up to 1.13 of the library. It arises from improper handling of deserialization inputs, making the system susceptible to remote exploitation without requiring authentication.\nThe risk is categorized as high, given the availability of public exploit material and the lack of a vendor response or official patch. Organizations integrating this library into their Java applications are at risk if they process untrusted JSON input using the affected deserialization function.\nSuccessful exploitation could allow an attacker to disrupt service availability or gain unauthorized control over the execution flow of the host application.",
  "technicalDetails": "The vulnerability resides in the JsonMergePatchDeserializer.java file within the java-json-tools json-patch library. The core issue involves the JsonMergePatch.fromJson function, which fails to adequately perform bounds checking or validate the size of input data during the deserialization of JSON objects.\nSpecifically, the deserializer process involves recursive parsing of complex or deeply nested JSON structures. When the input provided to JsonMergePatch.fromJson is maliciously crafted to exceed the expected stack depth or buffer capacity allocated for the deserialization process, the library triggers a stack-based buffer overflow.\nBecause Java's memory management typically abstracts direct stack access compared to C/C++, this type of overflow in a managed environment often manifests as a StackOverflowError that, if unhandled, leads to an immediate application crash. However, in specific contexts where this library interacts with native code or through complex serialization chains, this can be leveraged to corrupt the runtime stack, potentially redirecting execution flow.\nThe attack flow proceeds as follows: 1) The attacker identifies an application endpoint that accepts JSON input and uses java-json-tools for processing via the JsonMergePatch.fromJson method. 2) The attacker submits a specially crafted, deeply nested JSON payload designed to trigger the overflow condition. 3) The deserialization logic attempts to process this structure on the stack. 4) The stack memory limit is exceeded, resulting in a crash or potential memory corruption. 5) If successfully exploited, the attacker achieves a denial-of-service (DoS) state or potentially arbitrary code execution depending on the specific Java Virtual Machine (JVM) implementation and the surrounding application architecture.\nThis vulnerability is reachable remotely, as the deserializer function is typically exposed to external input in web-facing Java applications. No specific privilege or authentication is required to initiate the attack, provided the target application is configured to parse the malicious input.\nAffected versions include all releases up to 1.13. The lack of input sanitization and depth limiting within the parsing logic constitutes the root cause, making the library brittle against malformed or 'pathological' JSON inputs designed for resource exhaustion or overflow attacks."
}