← Vulnerability feed

Vulnerability record · CVE-2026-32285 · published 26 March 2026

CVE-2026-32285: Jsonparser project jsonparser vulnerability

Jsonparser Project · Jsonparser

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

7.5 CVSS 3.1 High EPSS 0.97% · top 39.5% CWE-129 · CWE-129CWE-1285 · CWE-1285
7.5CVSS 3.1 base score
0.97%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
21References, 1 tagged exploit
9 Sep 2026Last modified by NVD

Description

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/buger/jsonparser/issues/275 Issue TrackingThird Party Advisory
https://github.com/golang/vulndb/issues/4514 Issue TrackingThird Party Advisory
https://pkg.go.dev/vuln/GO-2026-4514 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:13548
https://access.redhat.com/errata/RHSA-2026:17121
https://access.redhat.com/errata/RHSA-2026:17123
https://access.redhat.com/errata/RHSA-2026:19099
https://access.redhat.com/errata/RHSA-2026:21769
https://access.redhat.com/errata/RHSA-2026:22347
https://access.redhat.com/errata/RHSA-2026:22423
https://access.redhat.com/errata/RHSA-2026:23345
https://access.redhat.com/errata/RHSA-2026:34364
https://access.redhat.com/errata/RHSA-2026:35111
https://access.redhat.com/errata/RHSA-2026:36882
https://access.redhat.com/errata/RHSA-2026:61314
https://access.redhat.com/errata/RHSA-2026:7191
https://access.redhat.com/errata/RHSA-2026:9385
https://access.redhat.com/security/cve/CVE-2026-32285
https://bugzilla.redhat.com/show_bug.cgi?id=2451846
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32285.json
https://securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026 ExploitThird Party Advisory

Track CVE-2026-32285 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2020-35381Jsonparser project jsonparser vulnerabilityjsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.EPSS 2.3%7.5CVE-2020-10675Jsonparser project jsonparser vulnerabilityThe Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.EPSS 2.6%8.8CVE-2022-48503Apple WebKit bounds check flaw allows code execution via web contentApple fixed an insufficient bounds-checking issue in WebKit across Safari, iOS, iPadOS, macOS, tvOS and watchOS. Processing malicious web content can…KEVEPSS 3.2%analysed

Source: NIST National Vulnerability Database (record CVE-2026-32285), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.