Live › vulnerability › CVE-2026-120194
json-glib's JSONPath slice evaluator, used by json_path_query(), can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be made to hang, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 10:34 UTC. All times on this page are UTC.
Applications that pass attacker-controlled JSONPath expressions to json-glib's json_path_query() (or json_path_compile()/json_path_match()) can be hung by a slice with a negative step, e.g. $[:5:-1]. Programs that use only fixed, application-defined JSONPath expressions, or that never use JSONPath, can skip it. Red Hat says all shipped Red Hat and Fedora builds with the slice evaluator are vulnerable. Upstream version range is not stated.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-120194")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.