cJSON through version 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when processing untrusted RFC 6902 JSON Patch documents. The vulnerability is triggered via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() functions. Malicious patch documents using 'add' and 'copy' operations can duplicate subtrees to amplify document depth beyond the parser's nesting limit. The cJSON_Delete() function recurses without any depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, which is ten times the parser's 1000-level nesting limit. This mismatch is sufficient to overflow a default thread stack on most systems. An attacker who can supply a crafted patch document can crash the process, resulting in a denial of service condition.