Executive brief
A vulnerability in a widely used Go library for processing JSON data can allow an attacker to crash applications that use it. By sending a specially crafted, malformed JSON payload, an attacker can trigger a system error that shuts down the service, leading to a denial of service. This affects several Red Hat cloud management products that incorporate the vulnerable library.
Technical details
A denial of service vulnerability exists in the github.com/buger/jsonparser library due to improper validation of array indexes (CWE-129/CWE-1285). The Delete() function in parser.go computes an offset that can become negative when processing malformed JSON input. Because this negative value is used as a slice index without a lower-bound check, it triggers a Go runtime panic ("slice bounds out of range [-1:]"). An unauthenticated remote attacker can exploit this by providing a malformed JSON payload to any service that calls Delete() on untrusted input. This issue is distinct from the infinite loop bug addressed in CVE-2020-10675. The vulnerability is fixed in version 1.1.2.
Affected products
- buger jsonparser before v1.1.2
- Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2
- Red Hat multicluster engine for Kubernetes 2.8, 2.10
Timeline
- 2026-02-19: disclosed: Issue reported on GitHub and Go vulnerability database
- 2026-03-16: advisory: Go vulnerability report GO-2026-4514 published
- 2026-03-26: advisory: CVE-2026-32285 published to NVD
- 2026-05-04: patched: Red Hat released security updates for Advanced Cluster Management