CVE-2026-32285

Published: Mar 26, 2026Modified: Jul 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

Affected (1)

Products: Jsonparser Project: Jsonparser

Jsonparser Project

1 product

Jsonparser

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jsonparser Project Jsonparser	Before 1.1.2

Related CWEs

CWE-1285

Improper Validation of Specified Index, Position, or Offset in Input

The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.

CWE-129

Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

References (20)

https://github.com/buger/jsonparser/issues/275

Source: security@golang.org

Issue TrackingThird Party Advisory

https://github.com/golang/vulndb/issues/4514

Source: security@golang.org

Issue TrackingThird Party Advisory

https://pkg.go.dev/vuln/GO-2026-4514

Source: security@golang.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2026:13548