CVE-2026-86319

Medium [CVE-2026-86319] java-json-tools json-patch: Resource Consumption Vulnerability

CVE-2026-86319Source published Sep 7, 2026Source updated Sep 7, 2026

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. By manipulating input, an attacker can cause excessive resource consumption, leading to a Denial of Service (DoS) condition. An attacker can craft a malicious JSON Patch document containing deeply nested structures, excessively large arrays, or recursive references that cause the parser to enter an…

Affected products in this advisory

• Red Hat build of Apicurio Registry 3
• Red Hat build of Debezium 3
• Red Hat Build of Keycloak
• Red Hat build of Quarkus

1 more entries in the full advisory.

Source-reported affected versions

• 1.13

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• There is no official patch available for this vulnerability. Until a fix is released, administrators can implement the following mitigations to reduce the risk of resource exhaustion attacks: 1. Implement strict input validation on JSON Patch documents before passing them to JsonPatch.apply(), including maximum depth limits for nested objects (e.g., depth <= 10), maximum array size limits (e.g., array length <= 1000), and maximum total document size (e.g., <= 100KB). 2. Set timeouts on JSON Patch parsing and application operations to prevent indefinite execution. Implement circuit breakers that abort processing if execution time exceeds reasonable thresholds (e.g., 5 seconds). 3. Apply rate limiting on API endpoints or services that accept JSON Patch documents to prevent rapid repeated attacks from a single source. 4. Configure resource limits (memory, CPU) for Java processes that use json-patch to prevent a single request from consuming all system resources. 5. Where possible, restrict JSON Patch processing to authenticated and trusted sources only. Avoid exposing json-patch functionality directly to unauthenticated external users. 6. Monitor application logs and metrics for unusual resource consumption patterns that may indicate exploitation attempts. Continue to monitor for updates from the json-patch project maintainers and apply patches when they become available.