# CVE-2026-120194: json-glib infinite loop in JSONPath slice evaluator

Source: https://junglewise.ai/threats/cve-2026-120194-a-flaw-was-found-in-json-glib-the-jsonpath-slice-evaluator-used  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-120194 · Severity: high · CVSS 7.5 · Published 2026-10-31

json-glib is a library used by many applications to parse and query JSON data. A flaw in its JSONPath query function can cause it to enter an infinite loop when processing a malicious expression with a negative step value, causing affected applications to hang and become unresponsive. An attacker who can control the JSONPath expressions evaluated by an application can trigger a denial of service.

Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-120194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120194 being exploited in the wild.

**How severe is CVE-2026-120194?** High severity, with a CVSS score of 7.5, published 31 October 2026.

**Which products and versions are affected?** Gnome Json-Glib all currently shipped versions containing the JSONPath slice evaluator.

**Is there a fix for CVE-2026-120194?** No fixed version is recorded yet. Do not evaluate untrusted JSONPath expressions with json_path_query() or json_path_compile()/json_path_match() until a fix is available; instead, use fixed, application-defined path expressions and reject or avoid slice expressions that specify a negative step.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-31"}, {"kind": "other", "at": "2026-10-31", "note": "Red Hat security advisory published; no upstream fix available yet"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120194 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120194?** Check whether you run Gnome Json-Glib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not evaluate untrusted JSONPath expressions with json_path_query() or json_path_compile()/json_path_match() until a fix is available; instead, use fixed, application-defined path expressions and reject or avoid slice expressions that specify a negative step.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-31"}, {"kind": "other", "at": "2026-10-31", "note": "Red Hat security advisory published; no upstream fix available yet"}]

## Technical details

The JSONPath slice evaluator in json-glib's json_path_query() function contains a logic flaw that causes it to enter an infinite loop when processing slice expressions with a negative step (e.g., $[:5:-1]). The vulnerability requires that an attacker can supply a crafted JSONPath expression to an application that evaluates it with json-glib's query APIs; applications using only fixed, application-defined expressions are not vulnerable. No fix has been released yet.

## Affected products

- GNOME json-glib all currently shipped versions containing the JSONPath slice evaluator

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-120194](https://access.redhat.com/security/cve/CVE-2026-120194)