A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Java-json-tools
  • Json-patch

No data.

No data.

References
Link Providers
https://github.com/java-json-tools/json-patch/ cve-icon cve-icon
https://github.com/java-json-tools/json-patch/issues/167 cve-icon cve-icon
https://vuldb.com/cve/CVE-2026-86319 cve-icon cve-icon
https://vuldb.com/submit/908321 cve-icon cve-icon
https://vuldb.com/vuln/399510 cve-icon cve-icon
https://vuldb.com/vuln/399510/cti cve-icon cve-icon
History

Wed, 09 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption
First Time appeared Java-json-tools
Java-json-tools json-patch
Weaknesses CWE-400
CWE-404
CPEs cpe:2.3:a:java-json-tools:json-patch:*:*:*:*:*:*:*:*
Vendors & Products Java-json-tools
Java-json-tools json-patch
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-07T14:45:07.734Z

Updated: 2026-09-09T14:43:25.386Z

Reserved: 2026-09-07T05:33:02.820Z

Link: CVE-2026-86319

cve-icon Vulnrichment

Updated: 2026-09-09T14:43:18.159Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T15:17:34.250

Modified: 2026-09-09T15:17:17.203

Link: CVE-2026-86319

cve-icon Redhat

No data.