CVE-2026-32285 github.com/buger/jsonparser CVE debrief

Who should care

Organizations using the Jsonparser Project's Jsonparser should prioritize patching this vulnerability to prevent potential denial of service attacks. Security teams and administrators responsible for maintaining Jsonparser Project Jsonparser installations should take immediate action to mitigate this vulnerability.

Technical summary

The vulnerability exists in the Delete function of the Jsonparser Project's Jsonparser. When processing malformed JSON input, the function fails to properly validate offsets, resulting in a negative slice index and a runtime panic. This allows an attacker to launch a denial of service attack. The vulnerability is caused by inadequate input validation and can be exploited by sending malicious JSON input to the affected function.

Defensive priority

High priority should be given to patching this vulnerability, as it can be exploited for denial of service attacks. Security teams should work with developers to ensure that the patched version of Jsonparser Project Jsonparser is deployed as soon as possible.

Recommended defensive actions

• Apply the patch from the vendor or upgrade to a version that includes the fix.
• Implement input validation to prevent malformed JSON input from being processed.
• Monitor Jsonparser Project Jsonparser installations for potential attacks.
• Review and update security policies to ensure that Jsonparser Project Jsonparser is properly secured.
• Consider implementing compensating controls, such as web application firewalls, to detect and prevent attacks.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and severity. The source item URL provides additional information on the vulnerability, including references to issue tracking and third-party advisories.

Official resources