CVE-2026-86319

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86319
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86319.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86319
Published
2026-09-07T14:45:07Z
Modified
2026-09-10T03:30:46Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption
Details

A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of the file src/main/java/com/github/fge/jsonpatch/JsonPatch.java of the component Patch Operation Handler. The manipulation leads to resource consumption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-400",
        "CWE-404"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86319.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0"
                },
                {
                    "last_affected": "1.0"
                },
                {
                    "introduced": "1.1"
                },
                {
                    "last_affected": "1.1"
                },
                {
                    "introduced": "1.10"
                },
                {
                    "last_affected": "1.10"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/java-json-tools/json-patch

Affected ranges

Type
GIT
Repo
https://github.com/java-json-tools/json-patch
Events
Introduced
5922bdcee44d9e58335cdbdbcc35b3bcfe43d38a
Last Affected
7c391b5d3c6b1649178c7278c1096b65e974e4ae
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.2"
        },
        {
            "last_affected": "1.2"
        },
        {
            "introduced": "1.3"
        },
        {
            "last_affected": "1.3"
        },
        {
            "introduced": "1.4"
        },
        {
            "last_affected": "1.4"
        },
        {
            "introduced": "1.5"
        },
        {
            "last_affected": "1.5"
        },
        {
            "introduced": "1.6"
        },
        {
            "last_affected": "1.6"
        },
        {
            "introduced": "1.7"
        },
        {
            "last_affected": "1.7"
        },
        {
            "introduced": "1.8"
        },
        {
            "last_affected": "1.8"
        },
        {
            "introduced": "1.9"
        },
        {
            "last_affected": "1.9"
        },
        {
            "introduced": "1.11"
        },
        {
            "last_affected": "1.11"
        },
        {
            "introduced": "1.12"
        },
        {
            "last_affected": "1.12"
        },
        {
            "introduced": "1.13"
        },
        {
            "last_affected": "1.13"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.11
1.12
1.13
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
v1.*
v1.11
v1.13

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86319.json"