Skip to content
Fencer Intel
high 7.5

CVE-2026-32285 json

Denial of service in github.com/buger/jsonparser

published 7mo ago modified last mo. also GHSA-6g7g-w4f8-9c9x , GO-2026-4514 , EUVD-2026-16345

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

Patch / fix

  • go github.com/buger/jsonparser 1.1.2
  • github.com/buger/jsonparser github.com/buger/jsonparser 1.1.2
  • Red Hat Cluster Observability Operator 1.5.0 1787593705
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.4 1782405469
  • Red Hat multicluster engine for Kubernetes 2.1 1779135478
  • Red Hat multicluster engine for Kubernetes 2.8 1778288646, 1778288655
  • Red Hat Multicluster Global Hub 1.3.4 1779212259
  • Red Hat Multicluster Global Hub 1.4.5 1779579439
  • Red Hat Multicluster Global Hub 1.6.5 1780167118
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1782693386
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 1777142269
  • Red Hat Red Hat Hardened Images 0.72.0-0.1.hum1, 1.42.4-0.1.hum1
  • Red Hat Red Hat multicluster global hub 1.5.3 1778867753
  • Red Hat Red Hat OpenShift distributed tracing 3.9.3 1776435613, 1776435680
  • golang-github-buger-jsonparser Debian 14 1.1.2-1

debian advisories DEBIAN-CVE-2026-32285

  • trivy hummingbird 1 0.72.0-0.1.hum1
  • syft hummingbird 1 1.42.4-0.1.hum1

red hat advisories RHSA-2026:35111RHSA-2026:7191

  • govulncheck-vulndb openSUSE Leap 15.6 0.0.20260326T203309-150000.1.155.2

suse advisories SUSE-SU-2026:1135-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • mcphost openSUSE Tumbleweed 0.34.0-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:10731-1

Is CVE-2026-32285 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-32285 updated cvss 7.5

github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel9-operator, openshift-logging/opa-openshift-rhel9, openshift-logging/loki-operator-bundle, openshift-logging/lokistack-gateway-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 openshift5/ose-prometheus-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/prometheus-rhel9 1787593705
    fixed: vendor fix RHSA-2026:61314
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-logging/logging-loki-rhel9 1791500729
    fixed: vendor fix RHSA-2026:83013
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.4 openshift-logging/logging-loki-rhel9 1782405469
    fixed: vendor fix RHSA-2026:34364
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1778288646, multicluster-engine 1778288655
    fixed: vendor fix RHSA-2026:17121
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine 1779135478
    fixed: vendor fix RHSA-2026:19099
show 12 more
  • Red Hat Multicluster Global Hub 1.3.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779212259
    fixed: vendor fix RHSA-2026:22423
  • Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779579439
    fixed: vendor fix RHSA-2026:22347
  • Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1778867753
    fixed: vendor fix RHSA-2026:21769
  • Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1780167118
    fixed: vendor fix RHSA-2026:23345
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/acm-grafana-rhel9 1782693386
    fixed: vendor fix RHSA-2026:36882
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2 1777142269
    fixed: vendor fix RHSA-2026:13548
  • Red Hat Hardened Images syft 1.42.4-0.1.hum1, trivy 0.72.0-0.1.hum1
    fixed: vendor fix RHSA-2026:7191
  • Red Hat OpenShift distributed tracing 3.9.3 rhosdt 1776435613, rhosdt 1776435680
    fixed: vendor fix RHSA-2026:9385
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1787593946, cluster-observability-operator/thanos-rhel9 1787594087, cluster-observability-operator/korrel8r-rhel9 1787593952, cluster-observability-operator/alertmanager-rhel9 1787593799, cluster-observability-operator/perses-rhel9-operator 1787593697, cluster-observability-operator/logging-console-plugin-rhel9 1787593634, +18 more Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-logging/vector-rhel9 1791777198, openshift-logging/eventrouter-rhel9 1791500947, openshift-logging/loki-rhel9-operator 1791499216, openshift-logging/opa-openshift-rhel9 1791500883, openshift-logging/loki-operator-bundle 1791504713, openshift-logging/lokistack-gateway-rhel9 1791500864, +3 more Red Hat Logging Subsystem for Red Hat OpenShift 6.4 openshift-logging/vector-rhel9 1782393583, openshift-logging/eventrouter-rhel9 1782408807, openshift-logging/loki-rhel9-operator 1782464542, openshift-logging/opa-openshift-rhel9 1782392937, openshift-logging/loki-operator-bundle 1782465285, openshift-logging/lokistack-gateway-rhel9 1782392961, +3 more Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1778503196, multicluster-engine 1778503284, multicluster-engine 1778503297, multicluster-engine 1778503377 Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine 1779182390, multicluster-engine 1779182435, multicluster-engine 1779182459, multicluster-engine 1779182477 Red Hat Multicluster Global Hub 1.3.4 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779210675, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779210608, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779209992, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779925031, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779924243
    +6 more products
    Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779838819, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779839447, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779887217, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779891163, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779147132 Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779828691, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779828813, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779828536, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779837290, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779835152 Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1780320809, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1780321673, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779839087, multicluster-globalhub/multicluster-globalhub-operator-bundle 1780370487, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779839762 Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/thanos-rhel9 1783122371, rhacm2/acm-cli-rhel9 1783350872, rhacm2/console-rhel9 1783451729, rhacm2/prometheus-rhel9 1783259161, rhacm2/acm-search-v2-rhel9 1783381100, rhacm2/node-exporter-rhel9 1783327463, +37 more Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2 1776395605, rhacm2 1776437108, rhacm2 1776440706, rhacm2 1776440738, rhacm2 1776555620, rhacm2 1776641849, +38 more Red Hat Ansible Automation Platform 2 ansible-automation-platform/platform-operator-bundle
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 cri-tools, openshift4/oc-mirror-plugin-rhel9, openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-agent-installer-api-server-rhel9, openshift4/ose-container-networking-plugins-rhel9, openshift4/container-networking-plugins-microshift-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift distributed tracing 3.9.3 rhosdt 1776435565, rhosdt 1776435608, rhosdt 1776435631, rhosdt 1776435643, rhosdt 1776674955 Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-rhel9-operator, openshift4-wincw/windows-machine-config-operator-bundle
    not affected: vulnerable code not present
  • Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
7mo ago

Exploit prediction

0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • securityinfinity.com https://securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/buger/jsonparser
<1.1.2
1.1.2

Affected products

  • github.com/buger/jsonparser github.com/buger/jsonparser
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.4
  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat Multicluster Global Hub 1.3.4
  • Red Hat Multicluster Global Hub 1.4.5
  • Red Hat Multicluster Global Hub 1.6.5
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat multicluster global hub 1.5.3
  • Red Hat Red Hat OpenShift distributed tracing 3.9.3
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift for Windows Containers
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat OpenStack Platform 18.0

Classification

Weakness
  • CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
  • CWE-129 Improper Validation of Array Index
  • CWE-125 Out-of-bounds Read

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.