Control: tags -1 + patch Hi,
Each of the three CVEs now has an open, mergeable upstream pull request that names it. All three are from the same contributor and include regression tests: CVE-2026-67215 https://www.google.com/url?q=https://github.com/DaveGamble/cJSON/pull/1115&source=gmail&ust=1793769841720000&sa=E "Cap JSON Patch graft depth at the nesting limit" cJSON_Utils.c +74 -1, tests/misc_utils_tests.c CVE-2026-67216 https://www.google.com/url?q=https://github.com/DaveGamble/cJSON/pull/1116&source=gmail&ust=1793769841720000&sa=E "Bound cJSON_Compare cost: sort-based objects, depth cap" cJSON.c +133 -26, cJSON_Utils.c +122 -20, tests/compare_tests.c CVE-2026-67217 https://www.google.com/url?q=https://github.com/DaveGamble/cJSON/pull/1114&source=gmail&ust=1793769841720000&sa=E "Apply JSON Patch arrays atomically" cJSON_Utils.c +36 -29, cJSON_Utils.h (comment only), tests/misc_utils_tests.c Verified on the Debian 1.7.19-2 source with its patch applied. I built with cmake, -DENABLE_CJSON_UTILS=On and -DENABLE_SANITIZERS=On (ASan+UBSan, leak checking on). - Each PR applies cleanly on its own (#1116 with offsets only). - All three together, plus #1120 for CVE-2026-29036 (#1146718), also apply. The only conflict is between #1114 and #1115, which add tests at the same place in tests/misc_utils_tests.c; I merged that by hand. - Full test suite: 22/22 passed for each PR alone and for all four combined, with no sanitizer reports. - Each PR's new regression test fails on unpatched 1.7.19-2 and passes with the PR: #1115 apply_patches_should_reject_grafts_past_the_nesting_limit #1116 cjson_compare_should_fail_safe_past_nesting_limit #1114 apply_patches_should_leave_document_untouched_when_a_patch_fails Notes for whoever takes this: - #1114 changes documented behaviour. cJSONUtils_ApplyPatches() and ApplyPatchesCaseSensitive() become atomic; the old header comment said they were explicitly not, and suggested a duplicate-and-swap wrapper. There is no ABI change (the header change is only that comment), but callers that relied on partial application would see a difference. - #1116 also changes cJSON.c (cJSON_Compare), so it affects libcjson1 as well as libcjson-utils. - None of these are merged upstream yet (no release since 1.7.19), so waiting for review there may be preferable to carrying them. Thanks!
