CVE-2026-32285High· 7.5▾ MidnightPoC availableThe Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.8%
Last analysed / modified upstream
Exploit / PoC code exists
The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.
jsonparser < 1.1.2Upgrade past the affected range:
jsonparser 1.1.2Affected packages:
github.com/buger/jsonparser < 1.1.2Patched in:
github.com/buger/jsonparser 1.1.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-32286High· 7.5The DataRow.Decode function fails to properly validate field lengths
CVE-2026-31912Medium· 5.5libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer
CVE-2026-0799High· 8.7In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value
CVE-2026-12478Medium· 4.8The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected
CVE-2026-34588High· 8.6OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
CVE-2023-1380High· 7.1A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel