Denial of service in github.com/buger/jsonparser
Priority HIGH 72CWE-129Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 13 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-129 and the CVSS impact.
Summary
The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00779 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/buger/jsonparser (github.com/buger/jsonparser): 1.1.2github.com/buger/jsonparser (Go): 1.1.2Red Hat: 15 advisoriesRed Hat: 13 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| github.com/buger/jsonparser | github.com/buger/jsonparser | before 1.1.2 | 1.1.2 | Patch available | CNA |
| — | github.com/buger/jsonparser (Go) | before 1.1.2 | 1.1.2 | Patch available | GHSA-6g7g-w4f8-9c9x |
- github.com/buger/jsonparser Vendorgithub.com/buger/jsonparser Affected before 1.1.2 Fixed in 1.1.2 Patch available CNA
- github.com/buger/jsonparser (Go) Vendor— Affected before 1.1.2 Fixed in 1.1.2 Patch available GHSA-6g7g-w4f8-9c9x
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jsonparser_project:jsonparser:*:*:*:*:*:*:*:* | before 1.1.2 | Vulnerable | Jsonparser Project |
- cpe:2.3:a:jsonparser_project:jsonparser:*:*:*:*:*:*:*:* Versions before 1.1.2 Vulnerable ·Jsonparser Project
Remediation
- Fix · CNA github.com/buger/jsonparser (github.com/buger/jsonparser) Fixed in 1.1.2
- Fix · GHSA-6g7g-w4f8-9c9x github.com/buger/jsonparser (Go) Fixed in 1.1.2 Advisory →
Red Hat 15 advisories
- RHSA-2026:83013 Released 2026-10-14 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.0.17
- Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
- RHSA-2026:61314 Released 2026-08-31 · Red Hat rating ImportantCluster Observability Operator 1.5.2
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
- RHSA-2026:36882 Released 2026-07-08 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
Show 12 more Red Hat advisories
- RHSA-2026:35111 Released 2026-07-02 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images trivy-0.72.0-0.1.hum1@aarch64, trivy-0.72.0-0.1.hum1@src, trivy-0.72.0-0.1.hum1@x86_64
- RHSA-2026:34364 Released 2026-07-01 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.4.6
- Logging Subsystem for Red Hat OpenShift 6.4 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +2
- RHSA-2026:23345 Released 2026-06-04 · Red Hat rating ImportantMulticluster Global Hub 1.6.2 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:22423 Released 2026-06-02 · Red Hat rating ImportantMulticluster Global Hub 1.3.4 security update
- Multicluster Global Hub 1.3.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:22347 Released 2026-06-01 · Red Hat rating ImportantMulticluster Global Hub 1.4.5 security update
- Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:21769 Released 2026-05-28 · Red Hat rating ImportantMulticluster Global Hub 1.5.4 security update
- Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:19099 Released 2026-05-19 · Red Hat rating ImportantAssisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.3
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9, registry.redhat.io/multicluster-engine/assisted-installer-rhel9, registry.redhat.io/multicluster-engine/assisted-service-9-rhel9
- RHSA-2026:17123 Released 2026-05-13 · Red Hat rating ImportantAssisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.8.6
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9, registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9, registry.redhat.io/multicluster-engine/assisted-installer-rhel9 +1
- RHSA-2026:17121 Released 2026-05-13 · Red Hat rating ImportantAssisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.8.6
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/assisted-service-8-rhel8
- RHSA-2026:13548 Released 2026-05-04 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.15.2 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +8
- RHSA-2026:9385 Released 2026-04-21 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Tempo) 3.9.2 release
- Red Hat OpenShift distributed tracing 3.9.3 registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9, registry.redhat.io/rhosdt/tempo-query-rhel9 +2
- RHSA-2026:7191 Released 2026-04-09 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images syft-1.42.4-0.1.hum1@aarch64, syft-1.42.4-0.1.hum1@src, syft-1.42.4-0.1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:61314 |
| Logging Subsystem for Red Hat OpenShift 6.0 | Fixed | RHSA-2026:83013 |
| Logging Subsystem for Red Hat OpenShift 6.4 | Fixed | RHSA-2026:34364 |
| Multicluster Global Hub 1.3.4 | Fixed | RHSA-2026:22423 |
| Multicluster Global Hub 1.4.9 | Fixed | RHSA-2026:22347 |
| Multicluster Global Hub 1.5.8 | Fixed | RHSA-2026:21769 |
| Multicluster Global Hub 1.6.6 | Fixed | RHSA-2026:23345 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 | Fixed | RHSA-2026:36882 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 | Fixed | RHSA-2026:13548 |
| Red Hat Hardened Images | Fixed | RHSA-2026:35111, RHSA-2026:7191 |
| Red Hat OpenShift distributed tracing 3.9.3 | Fixed | RHSA-2026:9385 |
| multicluster engine for Kubernetes 2.10 | Fixed | RHSA-2026:19099 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:17121, RHSA-2026:17123 |
Not affected: 16 products
- Cluster Observability Operator 1.5
- Logging Subsystem for Red Hat OpenShift 6.0
- Logging Subsystem for Red Hat OpenShift 6.4
- Multicluster Global Hub 1.3.4
- Multicluster Global Hub 1.4.9
- Multicluster Global Hub 1.5.8
- Multicluster Global Hub 1.6.6
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift distributed tracing 3.9.3
- Red Hat OpenShift for Windows Containers
- Red Hat OpenStack Platform 18.0
- multicluster engine for Kubernetes 2.10
- multicluster engine for Kubernetes 2.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32285
- 2026-10-03 Alias added: GHSA-6g7g-w4f8-9c9x
- 2026-10-09 Fix available: Cluster Observability Operator 1.5.3, Multicluster Global Hub 1.6.6 · Red Hat
- 2026-10-15 Fix available: RHSA-2026:83013 · Red Hat
- 2026-10-16 Fix available: Logging Subsystem for Red Hat OpenShift 6.0 · Red Hat
- 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
References
Advisory 4
More Jsonparser Project Jsonparser vulnerabilities
- TI-2020-08581 The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial… CVSS 3.1HIGH 7.5
- TI-2020-17962 jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error… CVSS 3.1HIGH 7.5
Sources
- CVE-2026-32285 · CVE Program
- CVE-2026-32285 · NVD
- FIRST EPSS
- GHSA-6g7g-w4f8-9c9x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-32285 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences