cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in
    cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose
    destination path cannot be resolved, the existing target member is detached and deleted before the
    operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or
    cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch
    document can destroy addressable members of the target document even though the API reports that the patch
    failed, defeating the all-or-nothing behavior callers rely on to reject bad patches. (CVE-2026-67217)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in     cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose     destination path cannot be resolved, the existing target member is detached and deleted before the     operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or     cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch     document can destroy addressable members of the target document even though the API reports that the patch     failed, defeating the all-or-nothing behavior callers rely on to reject bad patches. (CVE-2026-67217)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472792	Echo: cjson: security update to 1.7.18-3.1+deb13u1+e2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
472792	Echo: cjson: security update to 1.7.18-3.1+deb13u1+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
330724	Linux Distros Unpatched Vulnerability : CVE-2026-67217	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-67217

medium

Tenable Plugins

medium

medium

medium