CVE-2026-32285
Aliases:GO-2026-4514GHSA-6g7g-w4f8-9c9xRHSA-2026:7191DEBIAN-CVE-2026-32285CGA-22cr-vw93-4mj3CGA-24q5-gwp5-9578CGA-2639-8qgv-xq63CGA-2722-6qrg-q94cCGA-2834-rf54-8f5wCGA-2c7p-r6rw-mxpfCGA-34jc-pw4p-49q2CGA-35xg-p654-53c3CGA-3m7j-9qpr-7g7hCGA-3p76-xp4c-xxwgCGA-4ggh-5xfj-wg67CGA-4pw9-87p9-wc22CGA-4qp2-h87h-pvfpCGA-5627-4wq3-67vhCGA-5966-xpgx-c3p4CGA-5cg6-r7w6-qr2pCGA-5jgj-2qc5-7grcCGA-5jm6-74j8-w8wpCGA-5w3j-5v87-fvjxCGA-5wpp-3558-w23pCGA-64xp-9xrq-xhr5CGA-6539-45v5-3xgxCGA-67rf-xmw2-hw5xCGA-6c3v-rm4r-26p2CGA-6jrw-pj85-8v9mCGA-6p9x-cqw2-pcxjCGA-6x82-qc85-46g7CGA-745q-35pf-fc8gCGA-76f6-m35j-x55cCGA-77wx-r92r-2h39CGA-7ccq-3g8r-r49rCGA-7cjv-whm5-2gp9CGA-834q-fh96-5qwmCGA-84c4-rmw4-c8j6CGA-88c4-vj8f-r96jCGA-88qv-hq7v-53gqCGA-8fcm-xjx8-wwpwCGA-8gpj-vxhj-v9wqCGA-8jqg-f3qw-38xqCGA-8vwg-g3cm-pr2pCGA-8wp8-mv9m-87rxCGA-9555-qh4q-cx25CGA-97cg-m4c5-frhwCGA-99x6-mcjm-w62jCGA-99x9-82gr-54h3CGA-9j6q-f9jr-2g24CGA-9r87-xm5q-vrchCGA-cg2h-hx7q-9vgvCGA-cv3w-h758-g45gCGA-f355-73f9-p82xCGA-fh4q-q29j-cv4cCGA-fmg5-xvfm-73r7CGA-fmr2-mj7f-cm94CGA-fvjr-6cgv-5h8mCGA-fxpq-6rxv-5m33CGA-g2pm-5vp5-6m8gCGA-ggxv-34v7-x6xgCGA-gjh8-gw9v-qgj3CGA-gww8-9qf3-wxrfCGA-gxg7-rq5g-wjgpCGA-h46v-9wfr-5689CGA-h9j3-27j2-p2h4CGA-hgpc-rmmg-mx47CGA-hj53-q2h7-wfwgCGA-hr68-7893-8jw4CGA-hwxv-v87h-xcj9CGA-hx26-w394-hx4qCGA-hx4m-9rg4-8q6hCGA-j22w-rr5x-v6vwCGA-j5q4-g7ph-2292CGA-j76p-659c-fvr9CGA-jhc7-vx7j-rqpjCGA-jm7c-8f99-fmvmCGA-jrjg-c2hj-65pfCGA-m634-wpr9-g4gwCGA-m7mv-m5fg-gh4wCGA-m9w9-9rf2-3hxmCGA-mfj6-x694-cw87CGA-p32c-6rw6-j2g2CGA-p3h4-47fp-2m87CGA-p658-vfq7-2cprCGA-p668-q474-5x4vCGA-p8xm-x3w4-phq2CGA-pg36-chqh-53phCGA-pg6c-q4f4-43g7CGA-phjh-76wh-vqrxCGA-prxf-fggw-9m44CGA-23vf-9mm9-57r9CGA-2cv3-w82w-p63vCGA-2h85-rfxc-86xfCGA-2jpx-h2jm-hr7wCGA-2mgw-rqqg-68hrCGA-2x6g-3xqv-g862CGA-336m-49pw-6386CGA-33cf-jhc2-v95qCGA-35wq-mrm2-48w4CGA-364h-8w53-f244CGA-3gff-vhq3-w4crCGA-3hxg-7p88-mp3xCGA-3j6r-px52-q87cCGA-3m85-jj4f-h9xcCGA-3pjg-xwc4-r8v4CGA-435f-gwv7-74rxCGA-43vc-78vc-hvr9CGA-442f-jxm8-wp2xCGA-458q-8mjq-c6ffCGA-4h24-8ch6-pp49CGA-4hwc-76q2-42qqCGA-4px5-pc59-h96rCGA-4vc3-xrjc-qpjwCGA-4whh-4hph-72x8CGA-4xhw-m6mh-xw63CGA-5249-cg82-6r94CGA-55m5-vfjr-v69vCGA-568p-c8pr-rr85CGA-5948-8jfp-g47gCGA-5c8h-v92h-p885CGA-5ppp-wg2f-m2q9CGA-5vjf-wjpf-8h3gCGA-5w3c-847x-jphcCGA-62m3-3432-h596CGA-64hh-cfmr-xpj7CGA-659f-vwc8-mwf3CGA-6cqv-wv7v-g952CGA-6h6w-2c6w-5gg2CGA-6r6q-52ph-w9ccCGA-7368-p6jr-r7xmCGA-7388-8698-q9jwCGA-739w-4hw8-cq2xCGA-73qf-jw9h-jwjwCGA-7677-25qx-494mCGA-79gp-9wwh-4fr2CGA-7cph-c373-xh39CGA-7gc5-x6q8-gvgpCGA-7h3r-h8gh-h6fgCGA-7m55-hrgp-7x8pCGA-7x8g-jwq4-93q4CGA-82jf-w3r5-2wg4CGA-833g-4jhh-3qv8CGA-887x-7425-85w9CGA-88wc-2833-cppvCGA-8cqq-8p94-6vrqCGA-8f5h-68m3-9g87CGA-8h63-jvm6-wxghCGA-8hgp-jrjx-pgqpCGA-8p2f-v9x2-cqh8CGA-8qpx-j6jg-794rCGA-8vqm-gqhw-fh48CGA-952f-x388-rp78CGA-9725-pxvw-6jvgCGA-97h8-w34j-3xvfCGA-98xj-9jp9-86rhCGA-9gvf-mfpv-2cg3CGA-9rh4-869x-35wcCGA-9xg2-25jw-rg59CGA-c3xx-9gm6-x4q3CGA-c6j7-9cjg-9fhfCGA-c9x4-q2r3-938vCGA-ccmh-fhvg-55w5CGA-cf2c-2987-43g6CGA-chfh-hgpw-jxmhCGA-cpfc-82xh-r4qmCGA-cr78-9f8c-mjh6CGA-cw8p-mh46-526wCGA-f28w-9jf5-j2pcCGA-f5q8-9mgv-8c27CGA-f7m9-56q4-hm99CGA-f836-6xq6-8xgcCGA-f8fr-4rh2-9jmqCGA-fg63-42jv-fxhrCGA-fg6m-vpfp-8fc3CGA-fhcf-fp6j-mx75CGA-fhg9-jm9v-q84xCGA-fj25-f5qp-c3pgCGA-fmwm-wmfg-cqjcCGA-fp54-rp2v-8qrwCGA-fpfq-xm23-99j8CGA-fprh-7jx3-77vwCGA-frf9-jc8j-p548CGA-fvvm-5mm5-p5wpCGA-fxxc-hqhr-xwxxCGA-g79h-5mq2-44jgCGA-g7pj-pqf6-8rjfCGA-gqv6-64rx-jwc6CGA-h7f6-v4vg-gq2qCGA-h84c-hq8x-47q2CGA-hc9c-3fwq-xwrvCGA-hcf3-79q8-jp42CGA-hcm6-wm9x-jm3wCGA-hqcc-gxq2-vp35CGA-hw2q-6vj2-899hCGA-j294-2f8q-f432CGA-j33w-gm4x-c35pCGA-j56m-32wm-f2h4CGA-j62x-rvwp-wmrgCGA-j6m3-p337-8rg8CGA-j6xv-p2qc-xjhgCGA-j98q-4wgv-3c7xCGA-jg65-hmp9-v5jhCGA-jmf9-frpr-4wvgCGA-jmjh-5hxc-392cCGA-jrcc-chg2-xp3gCGA-jrmq-mcxc-9qj5CGA-jrph-qj4g-wv4gCGA-m288-x6w5-fvjmCGA-m5c3-m5gc-5mvqCGA-m6q6-r7rp-g43mCGA-m7p9-5653-4jw4CGA-mhrv-xj8h-wxw5CGA-mqhc-hv28-c6pxCGA-mv8j-pc8v-7p9qCGA-mw4j-rgf6-mfjrCGA-mxvq-r3jr-h6v6CGA-p385-5mrp-whrgCGA-pcfj-9227-x3pqCGA-pfpq-7443-g4m5CGA-pmqv-h4qh-m8qwCGA-pr3v-hx5v-jqrjCGA-q4ff-2f5x-hx6rCGA-q4fx-f3mr-m7jwCGA-q4xw-3xjr-g3wmCGA-q5rr-cj8r-34jcCGA-q76x-gx5f-f62qCGA-q946-rwg4-4rmgCGA-q98r-5j29-7x5mCGA-q9qc-8qvf-5c6cCGA-qcqg-crpc-pwrvCGA-qp6j-hw63-7pq4CGA-qqq4-pchw-v5cvCGA-r2jc-23g9-jfq3CGA-r4r6-79qp-fp9wCGA-r6r4-mm8j-7xw2CGA-rc82-f2fr-rgw7CGA-rc9f-m984-ghgcCGA-rcp4-2c3w-35fhCGA-rcpj-hq2q-7gh2CGA-rgh8-964q-466jCGA-rhpx-vf46-wmpmCGA-rprh-59xc-4g72CGA-rpvq-5853-jhrcCGA-rvcp-gv9x-jrq6CGA-rwgj-87x3-8f3gCGA-v32f-88x3-rhwhCGA-v33x-f657-fcf4CGA-v44f-xv7g-fm42CGA-v4fx-hqvm-ggmmCGA-v4xr-2f7v-rq84CGA-v584-g866-hcvpCGA-v58v-p52x-fjpqCGA-v5xx-jghq-pmgwCGA-v6c6-2p55-cj4pCGA-v6f9-q2wq-rg2jCGA-v6r4-m2wx-c37qCGA-v7j6-w5c8-mp5jCGA-vcf7-jp3w-gf67CGA-vg43-36fq-cfgpCGA-vghf-5qcg-j3cgCGA-vjhf-5xwc-862gCGA-vmqg-q259-4q7wCGA-vmvq-4rh6-x2xwCGA-vqjg-jf63-w6v7CGA-vqv3-4fg4-hqc4CGA-vr98-j26q-cqx5CGA-vv3j-x825-x53gCGA-vv5c-4h5x-5rvpCGA-vw4v-64qr-66fhCGA-vwhr-8m24-g6f5CGA-vx5c-9jcm-xv2hCGA-vx5p-gq7w-22p4CGA-vxvm-2r6g-wg3cCGA-w2rj-rr2r-8g7rCGA-w4fm-89j2-692mCGA-w6jh-ccgx-5cp3CGA-w6pv-8r2w-8fcvCGA-w7fr-3r8g-c7qhCGA-w8g3-c4xm-h572CGA-wcrp-h99m-679vCGA-wcv3-q793-8fchCGA-wg34-m8cr-9635CGA-wg53-vx3j-w9w5CGA-wmvq-pf3v-7grvCGA-wmxw-xxc6-rqfxCGA-wrw8-7pj6-vjcmCGA-wv2p-v2gv-3mx7CGA-wvcw-r7jp-4fw9CGA-ww26-vgm6-xqp8CGA-wxj5-8fvh-4hc9CGA-x374-99pr-36f5CGA-x3jm-hv56-mcpmCGA-x4cj-pvxr-x462CGA-x5jm-689c-pgm8CGA-x65m-hj2g-435fCGA-x6qc-qfx2-7594CGA-x7qv-4mg3-wqwqCGA-x8hv-qwpf-xc98CGA-x928-3jx4-j665CGA-x9p4-p6fh-jgjhCGA-xhq4-9h5g-96q9CGA-xj8w-fpf6-hf26CGA-xq2p-9pc8-mq8mCGA-xqfp-v2jx-mp73CGA-xr2f-9vrq-mj7jCGA-xr7h-r6hj-x627CGA-xrqm-p7xj-fph9CGA-xrvg-f56r-g2hmCGA-xv2q-mmpc-97gxCGA-xx34-v54c-rpjcCGA-xx4p-7cm3-p6gv
Advisory lineage Upstream: 2 Downstream: 7
Modified
Published: 26 Mar 2026, 19:40
Last modified:09 Sept 2026, 12:05
Vulnerability Summary
Overall Risk (default)
medium
40/100 CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.75% LOW
1% probability +0.21%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
26 Mar 2026, 19:40
Published
Vulnerability first disclosed
09 Sept 2026, 12:05
Last Modified
Vulnerability information updated
Description
The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.75%• Percentile: 53%
Techniques & Countermeasures
- CWE-129•Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
- CWE-1285•Improper Validation of Specified Index, Position, or Offset in Input
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Affected Systems
- chainguard•cg
< 0.2.225-r0
- chainguard•chainloop-cli
< 1.83.0-r1
- chainguard•chainloop-cli-fips
< 1.83.0-r1
- chainguard•chainloop-control-plane
< 1.83.0-r1
- chainguard•chainloop-control-plane-fips
< 1.83.0-r1
- chainguard•commercial-grafana-11.6
< 11.6.14-r0
- chainguard•commercial-grafana-12.1
< 12.1.10-r0
- chainguard•commercial-grafana-12.2
< 12.2.8-r0
- chainguard•commercial-grafana-12.3
< 12.3.6-r0
- chainguard•commercial-grafana-12.4
< 12.4.2-r0
- chainguard•cri-tools
< 1.35.0-r7
- chainguard•crictl
< 1.35.0-r7
- chainguard•dagger
< 0.20.2-r0
- chainguard•datadog-agent-7.71
< 0
- chainguard•datadog-agent-7.72
< 0
- chainguard•datadog-agent-7.73
< 0
- chainguard•datadog-agent-7.74
< 7.74.1-r11
- chainguard•datadog-agent-7.75
all
- chainguard•datadog-agent-7.76
< 7.76.3-r3
- chainguard•datadog-agent-fips-7.71
< 0
- chainguard•datadog-agent-fips-7.72
< 7.72.4-r8
- chainguard•datadog-agent-fips-7.73
< 7.73.3-r7
- chainguard•datadog-agent-fips-7.74
< 0
- chainguard•datadog-agent-fips-7.75
all
- chainguard•datadog-agent-fips-7.76
< 7.76.3-r3
- chainguard•deck
< 1.56.0-r2
- chainguard•deck-fips
< 1.56.0-r3
- chainguard•dgraph
< 25.3.0-r3
- chainguard•eksctl
< 0.224.0-r7
- chainguard•elastic-agent-8.19
< 8.19.14-r1
- chainguard•elastic-agent-fips-8.19
< 8.19.14-r1
- chainguard•elastic-otel-collector-9.3
< 0
- chainguard•elastic-otel-collector-fips-9.3
< 0
- chainguard•gitlab-runner-18.6
all
- chainguard•gitlab-runner-18.7
< 18.7.2-r10
- chainguard•gitlab-runner-18.8
< 18.8.0-r5
- chainguard•gitlab-runner-18.9
< 18.9.0-r4
- chainguard•gitlab-runner-fips-18.7
all
- chainguard•gitlab-runner-fips-18.8
< 18.8.0-r6
- chainguard•gitlab-runner-fips-18.9
< 18.9.0-r4
- chainguard•gitlab-runner-helper-18.7
< 18.7.2-r10
- chainguard•gitlab-runner-helper-18.8
< 18.8.0-r5
- chainguard•gitlab-runner-helper-18.9
< 18.9.0-r4
- chainguard•gitlab-runner-helper-fips-18.7
all
- chainguard•gitlab-runner-helper-fips-18.8
< 18.8.0-r6
- chainguard•gitlab-runner-helper-fips-18.9
< 18.9.0-r4
- chainguard•google-cloud-otel-ops-collector
< 0
- chainguard•goreleaser
< 2.14.3-r3
- chainguard•grafana-11.4
all
- chainguard•grafana-11.5
all
Showing first 50 affected entries in server-rendered view.
References (34)
- https://github.com/buger/jsonparser/issues/275
- https://github.com/golang/vulndb/issues/4514
- https://pkg.go.dev/vuln/GO-2026-4514
- https://nvd.nist.gov/vuln/detail/CVE-2026-32285
- https://github.com/buger/jsonparser/pull/276
- https://github.com/buger/jsonparser/commit/a69e7e01cd4ad67bdfd3ac2c080b9212af16f4b0
- https://cyber.securityinfinity.com/buger-jsonparser-negative-slice-panic-dos-2026
- https://github.com/buger/jsonparser
- https://github.com/buger/jsonparser/releases/tag/v1.1.2
- https://securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026
- https://access.redhat.com/security/cve/CVE-2026-32285
- https://bugzilla.redhat.com/show_bug.cgi?id=2451846
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32285.json
- https://access.redhat.com/errata/RHSA-2026:22423
- https://access.redhat.com/errata/RHSA-2026:22347
- https://access.redhat.com/errata/RHSA-2026:21769
- https://access.redhat.com/errata/RHSA-2026:23345
- https://access.redhat.com/errata/RHSA-2026:13548
- https://access.redhat.com/errata/RHSA-2026:7191
- https://access.redhat.com/errata/RHSA-2026:9385
- https://access.redhat.com/errata/RHSA-2026:19099
- https://access.redhat.com/errata/RHSA-2026:17121
- https://access.redhat.com/errata/RHSA-2026:17123
- https://access.redhat.com/errata/RHSA-2026:34364
- https://access.redhat.com/errata/RHSA-2026:35111
- https://access.redhat.com/errata/RHSA-2026:36882
- https://images.redhat.com/
- https://access.redhat.com/security/updates/classification/
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7191.json
- https://www.cve.org/CVERecord?id=CVE-2026-32285
- https://security-tracker.debian.org/tracker/CVE-2026-32285
- https://access.redhat.com/errata/RHSA-2026:61314
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32285.json