GitHub Advisoryadvisory · Go

GHSA-6g7g-w4f8-9c9x github.com/buger/jsonparser has a denial of service vulnerability

HIGH Published 2026-03-18 Modified 2026-04-27 Official page ↗
Aliases
CVE-2026-32285
Ecosystem
Go
Packages
github.com/buger/jsonparser
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125, CWE-129
Reviewed
2026-03-18

Affected packages

• Go github.com/buger/jsonparser: < 1.1.2 → fixed in 1.1.2

Description

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

Related

Alias · CVE (1)

  • CVE-2026-32285 The Delete function fails to properly validate offsets when processing malformed JSON input. vulnerability

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-129 Improper Validation of Array Index weakness

References