CVE-2026-29036 cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding
Attackers can corrupt data or delete unintended keys by exploiting JSON Pointer escape decoding flaws in cJSON, potentially bypassing authorization controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29036?
CVE-2026-29036 is a high-severity vulnerability in DaveGamble cJSON, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.
Weakness: CWE-706
Which versions are affected by CVE-2026-29036?
How do I fix CVE-2026-29036?
Upgrade to a fixed version.
Is CVE-2026-29036 being exploited?
There is no known exploitation of CVE-2026-29036 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-29036, ECHO-fc20-8bd8-847a, GHSA-89cr-7g9x-rjgw, UBUNTU-CVE-2026-29036.