ECHO-b709-48c4-0c80
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-b709-48c4-0c80.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-b709-48c4-0c80
- Upstream
- Withdrawn
- 2026-10-04T14:42:47Z
- Published
- 2026-07-30T09:29:44Z
- Modified
- 2026-10-04T15:00:04Z
- Summary
- The CVE reports that cJSONUtils_ApplyPatches() mutates the target when a patch fails part-way, "defeating the all-or-nothing behavior callers rely on". cJSON never offers that guarantee: cJSON_Utils.h documents "Note that ApplyPatches is NOT atomic on failure" and gives the Duplicate-then-swap recipe for callers that need atomicity. No memory-safety impact; the behaviour is the documented API contract. Upstream has not commented and Debian lists it unfixed with no fix in any suite.
- Details
- References