---
id: "CVE-2026-120194"
kind: "vulnerability"
aliases: ["CVE-2026-120194"]
title: "json-glib: negative JSONPath slice step makes json_path_query hang"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c", "glib", "gnome", "json-glib", "package"]
not_affected_if: ["fixed-path-expressions", "no-jsonpath-query", "trusted-input-only"]
published_at: "2026-10-31T10:16:38+00:00"
first_seen_at: "2026-10-31T10:34:56+00:00"
updated_at: "2026-10-31T10:37:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120194", "first_seen_at": "2026-10-31T10:34:56+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T10:37:07+00:00"}]
---

# json-glib: negative JSONPath slice step makes json_path_query hang

json-glib's JSONPath slice evaluator, used by json_path_query(), can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be made to hang, which is a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Search your code for json_path_query, json_path_compile and json_path_match. If any of them evaluates an expression a user or remote client supplies, you are exposed. Test: a slice with a negative step such as $[:5:-1] hangs. Check the installed version with: pkg-config --modversion json-glib-1.0

## Fix

No fixed upstream json-glib release as of 2026-10-31 (Red Hat CNA page). Until then, do not pass untrusted expressions to json_path_query() or json_path_compile()/json_path_match().

## Timeline

- 2026-10-31T10:34:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120194
- 2026-10-31T10:37:07+00:00 analyst — Red Hat CNA page read: Important, CWE-835, example $[:5:-1], no fixed upstream release, mitigation is to avoid untrusted JSONPath / negative-step slices. Upstream issue gitlab.gnome.org/GNOME/json-glib/-/issues/96 and NVD page would not load; affected version range and fixed release unknown. Settle it by reading upstream issue 96 or a json-glib release NEWS. Not verified against the maintainer's own words, so only the fix status and mitigation are marked.

## Documents

- [advisory] Red Hat CVE-2026-120194 (CNA) https://access.redhat.com/security/cve/CVE-2026-120194

## From the sources

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_