{"id":"CVE-2026-120194","kind":"vulnerability","aliases":["CVE-2026-120194"],"related":[],"title":"json-glib: negative JSONPath slice step makes json_path_query hang","description":"A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.","summary":"json-glib's JSONPath slice evaluator, used by json_path_query(), can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be made to hang, which is a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","glib","gnome","json-glib","package"],"not_affected_if":["fixed-path-expressions","no-jsonpath-query","trusted-input-only"],"how_to_check":"Search your code for json_path_query, json_path_compile and json_path_match. If any of them evaluates an expression a user or remote client supplies, you are exposed. Test: a slice with a negative step such as $[:5:-1] hangs. Check the installed version with: pkg-config --modversion json-glib-1.0","fix":"No fixed upstream json-glib release as of 2026-10-31 (Red Hat CNA page). Until then, do not pass untrusted expressions to json_path_query() or json_path_compile()/json_path_match().","status":"open","published_at":"2026-10-31T10:16:38+00:00","first_seen_at":"2026-10-31T10:34:56+00:00","triaged_at":"2026-10-31T10:35:53+00:00","updated_at":"2026-10-31T10:37:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T10:35:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"json-glib: negative JSONPath slice step makes json_path_query hang","impact":"low","summary":"json-glib's JSONPath slice evaluator, used by json_path_query(), can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be made to hang, which is a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["json-glib","c","gnome","glib"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker can hang the application, causing denial of service","analyst_note":"Confirm affected json-glib version range and the fixed release from the NVD entry or the upstream GNOME advisory; sources give no fix.","how_to_check":"- Check whether the application calls `json_path_query()` from json-glib on input that a user or remote client can control.\n- Check the installed json-glib version with `pkg-config --modversion json-glib-1.0`; the sources do not list affected ranges.","plain_action":"","needs_analyst":true,"not_affected_if":["no-jsonpath-query","trusted-input-only"],"who_is_affected":"Applications that pass attacker-controlled JSONPath expressions to json-glib's json_path_query() are exposed to a hang. Programs that only use json-glib on trusted JSON or never evaluate JSONPath can skip it. The sources do not give affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4092,"output_tokens":558,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected json-glib version range and the fixed release from the NVD entry or the upstream GNOME advisory; sources give no fix.","search":"'-120194':15A,18A '-2026':14A,17A 'applic':53B,104C 'attack':57B,108C 'attacker-control':56B,107C 'c':19B 'control':58B,109C 'cve':13A,16A 'denial':69B,121C 'enter':39B,90C 'evalu':32B,55B,83C,106C 'express':47B,60B,98C,111C 'flaw':73C 'forc':114C 'found':75C 'given':44B,95C 'glib':3A,20B,24B,28B,79C 'gnome':21B 'hang':12A,65B,117C 'infinit':41B,92C 'json':2A,9A,23B,27B,35B,78C,86C 'json-glib':1A,22B,26B,77C 'jsonpath':5A,30B,59B,81C,110C 'lead':118C 'loop':42B,93C 'made':63B 'make':8A 'negat':4A,50B,101C 'packag':25B 'path':10A,36B,87C 'queri':11A,37B,88C 'servic':71B,123C 'slice':6A,31B,46B,82C,97C 'step':7A,51B,102C 'use':33B,84C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass attacker-controlled JSONPath expressions to json-glib's json_path_query() (or json_path_compile()/json_path_match()) can be hung by a slice with a negative step, e.g. $[:5:-1]. Programs that use only fixed, application-defined JSONPath expressions, or that never use JSONPath, can skip it. Red Hat says all shipped Red Hat and Fedora builds with the slice evaluator are vulnerable. Upstream version range is not stated.","tier":"B","verified":{"fix":{"at":"2026-10-31T10:37:07Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-120194","run_id":1240},"mitigations":{"at":"2026-10-31T10:37:07Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-120194","run_id":1240},"workarounds":{"at":"2026-10-31T10:37:07Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-120194","run_id":1240}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T10:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120194","severity":null,"published_at":"2026-10-31T10:16:38+00:00","modified_at":"2026-10-31T10:16:38+00:00","first_seen_at":"2026-10-31T10:34:56+00:00","fetched_at":"2026-10-31T10:34:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120194:1240","url":null,"severity":null,"published_at":"2026-10-31T10:37:07+00:00","modified_at":"2026-10-31T10:37:07+00:00","first_seen_at":"2026-10-31T10:37:07+00:00","fetched_at":"2026-10-31T10:37:07+00:00","note":"Red Hat CNA page read: Important, CWE-835, example $[:5:-1], no fixed upstream release, mitigation is to avoid untrusted JSONPath / negative-step slices. Upstream issue gitlab.gnome.org/GNOME/json-glib/-/issues/96 and NVD page would not load; affected version range and fixed release unknown. Settle it by reading upstream issue 96 or a json-glib release NEWS. Not verified against the maintainer's own words, so only the fix status and mitigation are marked."}],"documents":[{"id":31487,"url":"https://access.redhat.com/security/cve/CVE-2026-120194","title":"Red Hat CVE-2026-120194 (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}