Remediate cJSON vulnerabilities CVE-2026-67215 and CVE-2026-67216

Title

Remediate cJSON vulnerabilities CVE-2026-67215 and CVE-2026-67216

Description

The image includes cJSON with vulnerabilities that may allow denial-of-service attacks when processing attacker-controlled JSON input.

Affected CVEs:

• CVE-2026-67215 — uncontrolled recursion leading to stack exhaustion.
• CVE-2026-67216 — inefficient algorithmic complexity in cJSON_Compare, potentially causing excessive CPU consumption.

Impact

An attacker who can provide malicious JSON Patch documents or JSON objects may be able to:

• Exhaust the application stack.
• Cause excessive CPU consumption.
• Crash or make the affected service unavailable.

The vulnerabilities are relevant when the application invokes:

• cJSONUtils_ApplyPatches()
• cJSONUtils_ApplyPatchesCaseSensitive()
• cJSON_Compare()

Affected Version

• cJSON versions through 1.7.19 are affected by CVE-2026-67215.
• The affected cJSON implementation also includes the comparison logic associated with CVE-2026-67216.

Required Action

• Upgrade to a vendor-confirmed cJSON version containing fixes for both CVEs.
• If no patched release is available, apply the vendor patch when published.
• As an interim mitigation, reject or limit deeply nested JSON Patch input.
• Avoid invoking vulnerable comparison or patch-processing functions on untrusted input where possible.
• Rebuild the image and run a vulnerability scan.

Acceptance Criteria

• A cJSON version containing fixes for both CVEs is integrated.
• CVE-2026-67215 and CVE-2026-67216 are no longer reported.
• Deeply nested and adversarial JSON inputs are covered by regression tests.
• The rebuilt image passes security scanning.

Fix Version

No confirmed upstream cJSON fix version was identified at the time of reporting. The target fix version is:

TBD — latest cJSON release containing fixes for CVE-2026-67215 and CVE-2026-67216