{"id":"CVE-2026-32285","title":"The Delete function fails to properly validate offsets when processing malformed JSON input","summary":"The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-129","CWE-1285","CWE-125"],"vendor":"jsonparser_project","product":"jsonparser","affected":["jsonparser < 1.1.2"],"patched":["jsonparser 1.1.2"],"published":"2026-03-26","updated":"2026-09-09","sourceUpdated":"2026-09-09T13:19:17.090","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32285","references":[{"url":"https://github.com/buger/jsonparser/issues/275","label":"security@golang.org"},{"url":"https://github.com/golang/vulndb/issues/4514","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-4514","label":"security@golang.org"},{"url":"https://access.redhat.com/errata/RHSA-2026:13548","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17121","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17123","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19099","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22423","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34364","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:35111","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61314","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7191","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:9385","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32285","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451846","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32285.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32285"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32285"},{"url":"https://github.com/buger/jsonparser/pull/276"},{"url":"https://github.com/buger/jsonparser/commit/a69e7e01cd4ad67bdfd3ac2c080b9212af16f4b0"},{"url":"https://github.com/buger/jsonparser"},{"url":"https://github.com/buger/jsonparser/releases/tag/v1.1.2"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","osv","go"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-03-30T14:05:55.547828Z"},"epss":0.0075,"epssPercentile":0.53465,"ingestedAt":"2026-07-02T12:34:40.390Z","aliases":["GHSA-6g7g-w4f8-9c9x","GO-2026-4514"],"ecosystem":"go","slug":"CVE-2026-32285","body":"## Overview\n\nThe Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.\n\n## Affected\n\n- `jsonparser < 1.1.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `jsonparser 1.1.2`\n\n## Vendor advisories\n\n- **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314)\n- **RHSA-2026:34364** · Red Hat · fixed in: Logging for Red Hat OpenShift 6.4 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34364)\n- **RHSA-2026:22423** · Red Hat · fixed in: Multicluster Global Hub 1.3.4 · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22423)\n- **RHSA-2026:22347** · Red Hat · fixed in: Multicluster Global Hub 1.4.5 · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22347)\n- **RHSA-2026:23345** · Red Hat · fixed in: Multicluster Global Hub 1.6.5 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23345)\n- **RHSA-2026:36882** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36882)\n- **RHSA-2026:13548** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13548)\n- **RHSA-2026:7191** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7191)\n- **RHSA-2026:35111** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:35111)\n- **RHSA-2026:9385** · Red Hat · fixed in: Red Hat OpenShift distributed tracing 3.9.3 · released 2026-04-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:9385)\n- **RHSA-2026:21769** · Red Hat · fixed in: Red Hat multicluster global hub 1.5.3 · released 2026-05-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:21769)\n- **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, Red Hat OpenShift GitOps · no fix planned: Logging Subsystem for Red Hat OpenShift, Red Hat OpenShift GitOps · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32285.json)\n\n## Package advisory (CVE-2026-32285)\n\nAffected packages:\n\n- `github.com/buger/jsonparser < 1.1.2`\n\nPatched in:\n\n- `github.com/buger/jsonparser 1.1.2`\n\nSource: https://osv.dev/vulnerability/GHSA-6g7g-w4f8-9c9x","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":201601,"id":"CVE-2026-32285","ts":1789399518096,"field":"exploit_available","old":"false","new":"true"},{"seq":200333,"id":"CVE-2026-32285","ts":1789397103189,"field":"exploit_available","old":"true","new":"false"},{"seq":198257,"id":"CVE-2026-32285","ts":1789391751429,"field":"exploit_available","old":"false","new":"true"},{"seq":196050,"id":"CVE-2026-32285","ts":1789383401991,"field":"exploit_available","old":"true","new":"false"},{"seq":194979,"id":"CVE-2026-32285","ts":1789380315082,"field":"exploit_available","old":"false","new":"true"},{"seq":193766,"id":"CVE-2026-32285","ts":1789378271389,"field":"exploit_available","old":"true","new":"false"},{"seq":192553,"id":"CVE-2026-32285","ts":1789376235525,"field":"exploit_available","old":"false","new":"true"},{"seq":191340,"id":"CVE-2026-32285","ts":1789373133856,"field":"exploit_available","old":"true","new":"false"},{"seq":190125,"id":"CVE-2026-32285","ts":1789369123553,"field":"exploit_available","old":"false","new":"true"},{"seq":188912,"id":"CVE-2026-32285","ts":1789368040905,"field":"exploit_available","old":"true","new":"false"},{"seq":187695,"id":"CVE-2026-32285","ts":1789364998531,"field":"exploit_available","old":"false","new":"true"},{"seq":186482,"id":"CVE-2026-32285","ts":1789363009636,"field":"exploit_available","old":"true","new":"false"},{"seq":185268,"id":"CVE-2026-32285","ts":1789360971752,"field":"exploit_available","old":"false","new":"true"},{"seq":184055,"id":"CVE-2026-32285","ts":1789357945928,"field":"exploit_available","old":"true","new":"false"},{"seq":182307,"id":"CVE-2026-32285","ts":1789354099907,"field":"exploit_available","old":"false","new":"true"},{"seq":181100,"id":"CVE-2026-32285","ts":1789352950338,"field":"exploit_available","old":"true","new":"false"},{"seq":179893,"id":"CVE-2026-32285","ts":1789350003497,"field":"exploit_available","old":"false","new":"true"},{"seq":178686,"id":"CVE-2026-32285","ts":1789347821384,"field":"exploit_available","old":"true","new":"false"},{"seq":177479,"id":"CVE-2026-32285","ts":1789346183683,"field":"exploit_available","old":"false","new":"true"},{"seq":176272,"id":"CVE-2026-32285","ts":1789342754303,"field":"exploit_available","old":"true","new":"false"},{"seq":176056,"id":"CVE-2026-32285","ts":1789342360888,"field":"exploit_available","old":"false","new":"true"},{"seq":175596,"id":"CVE-2026-32285","ts":1789338392380,"field":"exploit_available","old":"true","new":"false"},{"seq":174391,"id":"CVE-2026-32285","ts":1789334606791,"field":"exploit_available","old":"false","new":"true"},{"seq":173186,"id":"CVE-2026-32285","ts":1789333221995,"field":"exploit_available","old":"true","new":"false"},{"seq":172000,"id":"CVE-2026-32285","ts":1789330889058,"field":"exploit_available","old":"false","new":"true"},{"seq":170814,"id":"CVE-2026-32285","ts":1789328401464,"field":"exploit_available","old":"true","new":"false"},{"seq":169609,"id":"CVE-2026-32285","ts":1789326912974,"field":"exploit_available","old":"false","new":"true"},{"seq":168404,"id":"CVE-2026-32285","ts":1789323448368,"field":"exploit_available","old":"true","new":"false"},{"seq":167199,"id":"CVE-2026-32285","ts":1789319378122,"field":"exploit_available","old":"false","new":"true"},{"seq":165994,"id":"CVE-2026-32285","ts":1789318294316,"field":"exploit_available","old":"true","new":"false"},{"seq":164789,"id":"CVE-2026-32285","ts":1789315547326,"field":"exploit_available","old":"false","new":"true"},{"seq":163584,"id":"CVE-2026-32285","ts":1789313265583,"field":"exploit_available","old":"true","new":"false"},{"seq":162379,"id":"CVE-2026-32285","ts":1789311716455,"field":"exploit_available","old":"false","new":"true"},{"seq":161174,"id":"CVE-2026-32285","ts":1789308271630,"field":"exploit_available","old":"true","new":"false"},{"seq":160679,"id":"CVE-2026-32285","ts":1789304198155,"field":"exploit_available","old":"false","new":"true"},{"seq":158517,"id":"CVE-2026-32285","ts":1789299289074,"field":"exploit_available","old":"true","new":"false"},{"seq":157481,"id":"CVE-2026-32285","ts":1789296470752,"field":"exploit_available","old":"false","new":"true"},{"seq":156276,"id":"CVE-2026-32285","ts":1789294391737,"field":"exploit_available","old":"true","new":"false"},{"seq":155071,"id":"CVE-2026-32285","ts":1789292646958,"field":"exploit_available","old":"false","new":"true"},{"seq":153866,"id":"CVE-2026-32285","ts":1789289354670,"field":"exploit_available","old":"true","new":"false"},{"seq":153078,"id":"CVE-2026-32285","ts":1789285266684,"field":"exploit_available","old":"false","new":"true"},{"seq":148012,"id":"CVE-2026-32285","ts":1789270883759,"field":"exploit_available","old":"true","new":"false"},{"seq":146052,"id":"CVE-2026-32285","ts":1789269180854,"field":"exploit_available","old":"false","new":"true"},{"seq":144955,"id":"CVE-2026-32285","ts":1789266112308,"field":"exploit_available","old":"true","new":"false"},{"seq":143859,"id":"CVE-2026-32285","ts":1789262451960,"field":"exploit_available","old":"false","new":"true"},{"seq":142695,"id":"CVE-2026-32285","ts":1789261196655,"field":"exploit_available","old":"true","new":"false"},{"seq":141531,"id":"CVE-2026-32285","ts":1789258621718,"field":"exploit_available","old":"false","new":"true"},{"seq":140333,"id":"CVE-2026-32285","ts":1789256411951,"field":"exploit_available","old":"true","new":"false"},{"seq":139135,"id":"CVE-2026-32285","ts":1789254594483,"field":"exploit_available","old":"false","new":"true"},{"seq":137937,"id":"CVE-2026-32285","ts":1789251595583,"field":"exploit_available","old":"true","new":"false"}]}