CVE-2026-32285: Denial of service in github.com/buger/jsonparser

Modified

AliasesRHSA-2026:7191UBUNTU-CVE-2026-32285DEBIAN-CVE-2026-32285+310 more

Published 26-03-2026Last modified 09-09-2026

Vulnerability summary

CVE-2026-32285 is a high (CVSS 7.5) Improper Validation of Array Index vulnerability in github.com/buger/jsonparser. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55.9% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.78%

0%100%

Low · -0.19 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 4 · Related 5

OPENSUSE-SU-2026:10731-1 OPENSUSE-SU-2026:21483-1 RHSA-2026:35111 SUSE-SU-2026:1135-1 CGA-2QR9-W23H-H74X

Timeline

26-03-2026
PublishedVulnerability first disclosed.
09-09-2026
Last modifiedVulnerability information updated.

Description

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

CVSS metrics

8 scores · 8 sources · 1 version

v3.17.5

EPSS trend

Probability

0.78%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

Decrease -0.19 pp

From 0.97% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (securityinfinity.com)
Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard145 products

cg< 0.2.225-r0
chainloop-cli< 1.83.0-r1
chainloop-cli-fips< 1.83.0-r1
chainloop-control-plane< 1.83.0-r1
chainloop-control-plane-fips< 1.83.0-r1

commercial-grafana-11.6< 11.6.14-r0
commercial-grafana-12.1< 12.1.10-r0
commercial-grafana-12.2< 12.2.8-r0
commercial-grafana-12.3< 12.3.6-r0
commercial-grafana-12.4< 12.4.2-r0
cri-tools< 1.35.0-r7
crictl< 1.35.0-r7
dagger< 0.20.2-r0
datadog-agent-7.71All versions (No fix recorded)
datadog-agent-7.72All versions (No fix recorded)
datadog-agent-7.73All versions (No fix recorded)
datadog-agent-7.74< 7.74.1-r11
datadog-agent-7.75All versions (No fix recorded)
datadog-agent-7.76< 7.76.3-r3
datadog-agent-fips-7.71All versions (No fix recorded)
datadog-agent-fips-7.72< 7.72.4-r8
datadog-agent-fips-7.73< 7.73.3-r7
datadog-agent-fips-7.74All versions (No fix recorded)
datadog-agent-fips-7.75All versions (No fix recorded)
datadog-agent-fips-7.76< 7.76.3-r3
deck< 1.56.0-r2
deck-fips< 1.56.0-r3
dgraph< 25.3.0-r3
eksctl< 0.224.0-r7
elastic-agent-8.19< 8.19.14-r1
elastic-agent-fips-8.19< 8.19.14-r1
elastic-otel-collector-9.3All versions (No fix recorded)
elastic-otel-collector-fips-9.3All versions (No fix recorded)
gitlab-runner-18.6All versions (No fix recorded)
gitlab-runner-18.7< 18.7.2-r10
gitlab-runner-18.8< 18.8.0-r5
gitlab-runner-18.9< 18.9.0-r4
gitlab-runner-fips-18.7All versions (No fix recorded)
gitlab-runner-fips-18.8< 18.8.0-r6
gitlab-runner-fips-18.9< 18.9.0-r4
gitlab-runner-helper-18.7< 18.7.2-r10
gitlab-runner-helper-18.8< 18.8.0-r5
gitlab-runner-helper-18.9< 18.9.0-r4
gitlab-runner-helper-fips-18.7All versions (No fix recorded)
gitlab-runner-helper-fips-18.8< 18.8.0-r6
gitlab-runner-helper-fips-18.9< 18.9.0-r4
google-cloud-otel-ops-collectorAll versions (No fix recorded)
goreleaser< 2.14.3-r3
grafana-11.4All versions (No fix recorded)
grafana-11.5All versions (No fix recorded)
grafana-11.6< 11.6.13-r2
grafana-12.0All versions (No fix recorded)
grafana-12.1< 12.1.9-r2
grafana-12.2< 12.2.7-r2
grafana-12.3< 12.3.5-r2
grafana-12.4< 12.4.1-r2
grafana-alloy< 1.14.1-r2
grafana-alloy-fips< 1.14.1-r2
grafana-beyla< 3.6.0-r1
grafana-fips-11.4All versions (No fix recorded)
grafana-fips-11.5All versions (No fix recorded)
grafana-fips-11.6< 11.6.13-r4
grafana-fips-12.0All versions (No fix recorded)
grafana-fips-12.1< 12.1.9-r4
grafana-fips-12.2< 12.2.7-r2
grafana-fips-12.3< 12.3.5-r3
grafana-fips-12.4< 12.4.2-r0
influxd-2.7< 2.7.12-r15
jfrog-cli< 2.96.0-r2
k3s< 1.35.2.1-r2
k3s-1.31< 1.31.6.1-r15
k3s-1.32< 1.32.13.1-r6
k3s-1.33< 1.33.9.1-r4
k3s-static< 1.35.2.1-r2
k3s-static-1.31< 1.31.6.1-r15
k3s-static-1.32< 1.32.13.1-r6
k3s-static-1.33< 1.33.9.1-r4
k8sgpt< 0.4.30-r4
kubevela-vela-cli< 1.10.7-r5
kubevela-vela-cli-fips< 1.10.7-r6
kubevela-vela-core< 1.10.7-r5
kubevela-vela-core-fips< 1.10.7-r6
lazygit< 0.60.0-r4
loki-2.9< 2.9.17-r5
loki-2.9-logcli< 2.9.17-r5
loki-2.9-loki-canary< 2.9.17-r5
loki-2.9-promtail< 2.9.17-r5
loki-3.4< 3.4.6-r10
loki-3.4-logcli< 3.4.6-r10
loki-3.5< 3.5.12-r1
loki-3.5-logcli< 3.5.12-r1
loki-3.6< 3.6.7-r4
loki-3.6-logcli< 3.6.7-r4
loki-fips-2.9< 2.9.17-r6
loki-fips-2.9-logcli< 2.9.17-r6
loki-fips-2.9-loki-canary< 2.9.17-r6
loki-fips-2.9-promtail< 2.9.17-r6
loki-fips-3.4< 3.4.6-r9
loki-fips-3.4-logcli< 3.4.6-r9
loki-fips-3.5< 3.5.12-r2
loki-fips-3.5-logcli< 3.5.12-r2
loki-fips-3.6< 3.6.7-r4
loki-fips-3.6-logcli< 3.6.7-r4
malcontent< 1.21.3-r1
maru< 0.6.0-r11
mcp-grafana< 0.11.3-r5
mcp-grafana-fips< 0.11.3-r2
minio< 0.20251015.172955-r10
minio-fips< 0.20251015.172955-r11
modsAll versions (No fix recorded)
nfpm< 2.45.2-r3
nuclei< 3.7.1-r3
ollama< 0.18.2-r1
ollama-fips< 0.18.2-r1
opentelemetry-collector< 0.148.0-r1
opentelemetry-collector-contrib< 0.148.0-r3
opentelemetry-collector-contrib-fips< 0.148.0-r2
opentelemetry-collector-fipsAll versions (No fix recorded)
prometheus-3.10< 3.10.0-r3
prometheus-fips-3.10< 3.10.0-r2
rclone< 1.73.2-r2
rclone-fips< 1.73.3-r0
rpk-25.1.12< 25.1.12-r8
rpk-25.2.14< 25.2.14-r4
rpk-25.3.10< 25.3.10-r3
teleport-18< 18.7.2-r4
teleport-18.6< 18.6.8-r7
tempo-2.10< 2.10.3-r6
tempo-2.10-cli< 2.10.3-r6
tempo-2.10-vulture< 2.10.3-r6
tempo-2.9< 2.9.1-r3
tempo-2.9-cli< 2.9.1-r3
tempo-fips-2.10< 2.10.3-r2
tempo-fips-2.10-cli< 2.10.3-r2
tempo-fips-2.10-vulture< 2.10.3-r2
tempo-fips-2.9< 2.9.1-r3
tempo-fips-2.9-cli< 2.9.1-r3
terraform-mcp-server< 0.4.0-r3
terragrunt< 0.99.5-r1
terragrunt-fips< 0.99.4-r6
vcluster< 0.32.1-r7
vcluster-cli< 0.32.1-r7
vcluster-syncer< 0.32.1-r7
weaviate< 1.36.6-r1
witness< 0.10.2-r15

Show all 145

Wolfi55 products

cri-tools< 1.35.0-r7
crictl< 1.35.0-r7
dagger< 0.20.2-r0
datadog-agent-7.72All versions (No fix recorded)
datadog-agent-7.73All versions (No fix recorded)

Show all 55

2 vendors · 200 products · Showing 200 of 208

References

34 links

github.com/buger/jsonparser/issues/275ARTICLEREPORTWEBIssue TrackingThird Party Advisory
github.com/golang/vulndb/issues/4514ARTICLEREPORTWEBIssue TrackingThird Party Advisory
pkg.go.dev/vuln/GO-2026-4514AdvisoryREPORTWEBThird Party Advisory
securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026ExploitEVIDENCEWEBThird Party Advisory
access.redhat.com/security/cve/CVE-2026-32285VDB EntryX Refsource REDHATREPORTAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2451846Issue TrackingX Refsource REDHATREPORT
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32285.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:61314Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:34364Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:22423Vendor AdvisoryX Refsource REDHATAdvisory

Show all 34 references

access.redhat.com/errata/RHSA-2026:22347Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:23345Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:36882Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:13548Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:7191Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:35111Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:9385Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:21769Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:19099Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:17121Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:17123Vendor AdvisoryX Refsource REDHATAdvisory
images.redhat.comARTICLE
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7191.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2026-32285AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-32285Advisory
ubuntu.com/security/CVE-2026-32285REPORT
security-tracker.debian.org/tracker/CVE-2026-32285Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32285.jsonAdvisory
github.com/buger/jsonparser/pull/276WEB
github.com/buger/jsonparser/commit/a69e7e01cd4ad67bdfd3ac2c080b9212af16f4b0WEB
github.com/buger/jsonparserPACKAGE
github.com/buger/jsonparser/releases/tag/v1.1.2WEB