Description

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T15:17:34.250Z",
  "pubdate": "2026-09-07T15:17:34.250Z",
  "executiveSummary": "The java-json-tools json-patch library, specifically versions up to 1.13, contains a resource consumption vulnerability within the JsonPatch.apply function.\nThis vulnerability is classified as a denial-of-service (DoS) condition, where an attacker can remotely trigger excessive resource utilization by providing maliciously crafted JSON patch inputs.\nThe flaw resides in the Patch Operation Handler component, which fails to adequately sanitize or limit computational overhead during the application of patch operations.\nThe risk implication is significant as the exploit is publicly disclosed, potentially allowing unauthenticated remote attackers to exhaust server-side resources, leading to service degradation or system instability.\nNo official patch or vendor response has been provided, leaving affected systems exposed to exploitation via standard network vectors.",
  "technicalDetails": "The vulnerability is situated in the JsonPatch.apply function within the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java. The root cause pertains to an algorithmic complexity issue or insufficient validation logic within the Patch Operation Handler, which facilitates disproportionate resource consumption relative to the input size.\nDuring the execution of JsonPatch.apply, the library processes JSON patch operations against a target JSON document. The vulnerability allows an attacker to supply a crafted patch payload that forces the underlying recursive or iterative processing logic to enter a state of high CPU or memory utilization. Because the component does not implement adequate constraints on the complexity or depth of the patch operations, it becomes susceptible to resource exhaustion attacks.\nThe attack flow initiates when an unauthenticated remote attacker sends a specifically formatted JSON patch request to an application utilizing the vulnerable library. Upon receiving this payload, the target system invokes the JsonPatch.apply method. The malicious payload is designed to trigger intensive computational operations—potentially involving repeated nested lookups or deep recursive traversals—that consume significant CPU cycles or heap memory. This manipulation prevents the application from processing legitimate requests, effectively resulting in a denial-of-service condition.\nThe exploitation does not require prior authentication or elevated privileges, as the entry point is the external processing of untrusted JSON input. The attack is network-exploitable, assuming the application exposes a functional interface that accepts and applies JSON patches. Once the payload is parsed and the application logic attempts to apply the transformations, the exhaustion occurs synchronously, stalling the processing thread and potentially impacting the overall stability of the host environment.\nThe vulnerability is present in all versions of java-json-tools json-patch up to and including version 1.13. Post-exploitation, the impact is strictly limited to service availability; there is no evidence that this vulnerability leads to arbitrary code execution or unauthorized data access. However, given the public disclosure of the exploit, systems that perform JSON patching on untrusted user-supplied data are at high risk of disruption."
}