High severity7.5NVD Advisory· Published Mar 26, 2026· Updated Apr 21, 2026

CVE-2026-32285

Description

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/buger/jsonparserGo	< 1.1.2	1.1.2

Affected products

202

Jsonparser Project/Jsonparser
cpe:2.3:a:jsonparser_project:jsonparser:*:*:*:*:*:*:*:*
Range: <1.1.2
osv-coords201 versions
pkg:apk/chainguard/cg pkg:apk/chainguard/chainloop-cli pkg:apk/chainguard/chainloop-cli-fips pkg:apk/chainguard/chainloop-control-plane pkg:apk/chainguard/chainloop-control-plane-fips pkg:apk/chainguard/commercial-grafana-11.6 pkg:apk/chainguard/commercial-grafana-12.1 pkg:apk/chainguard/commercial-grafana-12.2 pkg:apk/chainguard/commercial-grafana-12.3 pkg:apk/chainguard/commercial-grafana-12.4 pkg:apk/chainguard/crictl pkg:apk/chainguard/cri-tools pkg:apk/chainguard/dagger pkg:apk/chainguard/datadog-agent-7.71 pkg:apk/chainguard/datadog-agent-7.72 pkg:apk/chainguard/datadog-agent-7.73 pkg:apk/chainguard/datadog-agent-7.74 pkg:apk/chainguard/datadog-agent-7.76 pkg:apk/chainguard/datadog-agent-fips-7.71 pkg:apk/chainguard/datadog-agent-fips-7.72 pkg:apk/chainguard/datadog-agent-fips-7.73 pkg:apk/chainguard/datadog-agent-fips-7.74 pkg:apk/chainguard/datadog-agent-fips-7.76 pkg:apk/chainguard/deck pkg:apk/chainguard/deck-fips pkg:apk/chainguard/dgraph pkg:apk/chainguard/eksctl pkg:apk/chainguard/elastic-agent-8.19 pkg:apk/chainguard/elastic-agent-fips-8.19 pkg:apk/chainguard/elastic-otel-collector-9.3 pkg:apk/chainguard/elastic-otel-collector-fips-9.3 pkg:apk/chainguard/gitlab-runner-18.7 pkg:apk/chainguard/gitlab-runner-18.8 pkg:apk/chainguard/gitlab-runner-18.9 pkg:apk/chainguard/gitlab-runner-fips-18.8 pkg:apk/chainguard/gitlab-runner-fips-18.9 pkg:apk/chainguard/gitlab-runner-helper-18.7 pkg:apk/chainguard/gitlab-runner-helper-18.8 pkg:apk/chainguard/gitlab-runner-helper-18.9 pkg:apk/chainguard/gitlab-runner-helper-fips-18.8 pkg:apk/chainguard/gitlab-runner-helper-fips-18.9 pkg:apk/chainguard/google-cloud-otel-ops-collector pkg:apk/chainguard/goreleaser pkg:apk/chainguard/grafana-11.6 pkg:apk/chainguard/grafana-12.1 pkg:apk/chainguard/grafana-12.2 pkg:apk/chainguard/grafana-12.3 pkg:apk/chainguard/grafana-12.4 pkg:apk/chainguard/grafana-alloy pkg:apk/chainguard/grafana-alloy-fips pkg:apk/chainguard/grafana-beyla pkg:apk/chainguard/grafana-fips-11.6 pkg:apk/chainguard/grafana-fips-12.1 pkg:apk/chainguard/grafana-fips-12.2 pkg:apk/chainguard/grafana-fips-12.3 pkg:apk/chainguard/grafana-fips-12.4 pkg:apk/chainguard/influxd-2.7 pkg:apk/chainguard/jfrog-cli pkg:apk/chainguard/k3s pkg:apk/chainguard/k3s-1.31 pkg:apk/chainguard/k3s-1.32 pkg:apk/chainguard/k3s-1.33 pkg:apk/chainguard/k3s-static pkg:apk/chainguard/k3s-static-1.31 pkg:apk/chainguard/k3s-static-1.32 pkg:apk/chainguard/k3s-static-1.33 pkg:apk/chainguard/k8sgpt pkg:apk/chainguard/kubevela-vela-cli pkg:apk/chainguard/kubevela-vela-cli-fips pkg:apk/chainguard/kubevela-vela-core pkg:apk/chainguard/kubevela-vela-core-fips pkg:apk/chainguard/lazygit pkg:apk/chainguard/loki-2.9 pkg:apk/chainguard/loki-2.9-logcli pkg:apk/chainguard/loki-2.9-loki-canary pkg:apk/chainguard/loki-2.9-promtail pkg:apk/chainguard/loki-3.4 pkg:apk/chainguard/loki-3.4-logcli pkg:apk/chainguard/loki-3.5 pkg:apk/chainguard/loki-3.5-logcli pkg:apk/chainguard/loki-3.6 pkg:apk/chainguard/loki-3.6-logcli pkg:apk/chainguard/loki-fips-2.9 pkg:apk/chainguard/loki-fips-2.9-logcli pkg:apk/chainguard/loki-fips-2.9-loki-canary pkg:apk/chainguard/loki-fips-2.9-promtail pkg:apk/chainguard/loki-fips-3.4 pkg:apk/chainguard/loki-fips-3.4-logcli pkg:apk/chainguard/loki-fips-3.5 pkg:apk/chainguard/loki-fips-3.5-logcli pkg:apk/chainguard/loki-fips-3.6 pkg:apk/chainguard/loki-fips-3.6-logcli pkg:apk/chainguard/malcontent pkg:apk/chainguard/maru pkg:apk/chainguard/mcp-grafana pkg:apk/chainguard/mcp-grafana-fips pkg:apk/chainguard/minio pkg:apk/chainguard/minio-fips pkg:apk/chainguard/mods pkg:apk/chainguard/nfpm pkg:apk/chainguard/nuclei pkg:apk/chainguard/ollama pkg:apk/chainguard/ollama-fips pkg:apk/chainguard/opentelemetry-collector pkg:apk/chainguard/opentelemetry-collector-contrib pkg:apk/chainguard/opentelemetry-collector-contrib-fips pkg:apk/chainguard/opentelemetry-collector-fips pkg:apk/chainguard/prometheus-3.10 pkg:apk/chainguard/prometheus-fips-3.10 pkg:apk/chainguard/rclone pkg:apk/chainguard/rclone-fips pkg:apk/chainguard/rpk-25.1.12 pkg:apk/chainguard/rpk-25.2.14 pkg:apk/chainguard/rpk-25.3.10 pkg:apk/chainguard/teleport-18 pkg:apk/chainguard/teleport-18.6 pkg:apk/chainguard/tempo-2.10 pkg:apk/chainguard/tempo-2.10-cli pkg:apk/chainguard/tempo-2.10-vulture pkg:apk/chainguard/tempo-2.9 pkg:apk/chainguard/tempo-2.9-cli pkg:apk/chainguard/tempo-fips-2.10 pkg:apk/chainguard/tempo-fips-2.10-cli pkg:apk/chainguard/tempo-fips-2.10-vulture pkg:apk/chainguard/tempo-fips-2.9 pkg:apk/chainguard/tempo-fips-2.9-cli pkg:apk/chainguard/terraform-mcp-server pkg:apk/chainguard/terragrunt pkg:apk/chainguard/terragrunt-fips pkg:apk/chainguard/vcluster pkg:apk/chainguard/vcluster-cli pkg:apk/chainguard/vcluster-syncer pkg:apk/chainguard/weaviate pkg:apk/chainguard/witness pkg:apk/wolfi/crictl pkg:apk/wolfi/cri-tools pkg:apk/wolfi/dagger pkg:apk/wolfi/datadog-agent-7.72 pkg:apk/wolfi/datadog-agent-7.73 pkg:apk/wolfi/datadog-agent-7.74 pkg:apk/wolfi/datadog-agent-7.76 pkg:apk/wolfi/dgraph pkg:apk/wolfi/eksctl pkg:apk/wolfi/gitlab-runner-18.7 pkg:apk/wolfi/gitlab-runner-18.8 pkg:apk/wolfi/gitlab-runner-18.9 pkg:apk/wolfi/gitlab-runner-helper-18.7 pkg:apk/wolfi/gitlab-runner-helper-18.8 pkg:apk/wolfi/gitlab-runner-helper-18.9 pkg:apk/wolfi/goreleaser pkg:apk/wolfi/grafana-11.6 pkg:apk/wolfi/grafana-12.1 pkg:apk/wolfi/grafana-12.2 pkg:apk/wolfi/grafana-12.3 pkg:apk/wolfi/grafana-12.4 pkg:apk/wolfi/grafana-alloy pkg:apk/wolfi/influxd-2.7 pkg:apk/wolfi/k3s pkg:apk/wolfi/k3s-1.32 pkg:apk/wolfi/k3s-1.33 pkg:apk/wolfi/k3s-static pkg:apk/wolfi/k3s-static-1.32 pkg:apk/wolfi/k3s-static-1.33 pkg:apk/wolfi/k8sgpt pkg:apk/wolfi/kubevela-vela-cli pkg:apk/wolfi/kubevela-vela-core pkg:apk/wolfi/lazygit pkg:apk/wolfi/loki-3.4 pkg:apk/wolfi/loki-3.4-logcli pkg:apk/wolfi/loki-3.5 pkg:apk/wolfi/loki-3.5-logcli pkg:apk/wolfi/loki-3.6 pkg:apk/wolfi/loki-3.6-logcli pkg:apk/wolfi/malcontent pkg:apk/wolfi/maru pkg:apk/wolfi/mcp-grafana pkg:apk/wolfi/minio pkg:apk/wolfi/mods pkg:apk/wolfi/nfpm pkg:apk/wolfi/nuclei pkg:apk/wolfi/ollama pkg:apk/wolfi/opentelemetry-collector pkg:apk/wolfi/opentelemetry-collector-contrib pkg:apk/wolfi/prometheus-3.10 pkg:apk/wolfi/rclone pkg:apk/wolfi/rpk-25.3.10 pkg:apk/wolfi/teleport-18 pkg:apk/wolfi/teleport-18.6 pkg:apk/wolfi/tempo-2.10 pkg:apk/wolfi/tempo-2.10-cli pkg:apk/wolfi/tempo-2.10-vulture pkg:apk/wolfi/terraform-mcp-server pkg:apk/wolfi/terragrunt pkg:apk/wolfi/vcluster pkg:apk/wolfi/vcluster-cli pkg:apk/wolfi/vcluster-syncer pkg:apk/wolfi/weaviate pkg:apk/wolfi/witness pkg:golang/github.com/buger/jsonparser pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/mcphost&distro=openSUSE%20Tumbleweed
< 0.2.225-r0+ 200 more
- (no CPE)range: < 0.2.225-r0
- (no CPE)range: < 1.83.0-r1
- (no CPE)range: < 1.83.0-r1
- (no CPE)range: < 1.83.0-r1
- (no CPE)range: < 1.83.0-r1
- (no CPE)range: < 11.6.14-r0
- (no CPE)range: < 12.1.10-r0
- (no CPE)range: < 12.2.8-r0
- (no CPE)range: < 12.3.6-r0
- (no CPE)range: < 12.4.2-r0
- (no CPE)range: < 1.35.0-r7
- (no CPE)range: < 1.35.0-r7
- (no CPE)range: < 0.20.2-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 7.74.1-r11
- (no CPE)range: < 7.76.3-r3
- (no CPE)range: < 0
- (no CPE)range: < 7.72.4-r8
- (no CPE)range: < 7.73.3-r7
- (no CPE)range: < 0
- (no CPE)range: < 7.76.3-r3
- (no CPE)range: < 1.56.0-r2
- (no CPE)range: < 1.56.0-r3
- (no CPE)range: < 25.3.0-r3
- (no CPE)range: < 0.224.0-r7
- (no CPE)range: < 8.19.14-r1
- (no CPE)range: < 8.19.14-r1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 18.7.2-r10
- (no CPE)range: < 18.8.0-r5
- (no CPE)range: < 18.9.0-r4
- (no CPE)range: < 18.8.0-r6
- (no CPE)range: < 18.9.0-r4
- (no CPE)range: < 18.7.2-r10
- (no CPE)range: < 18.8.0-r5
- (no CPE)range: < 18.9.0-r4
- (no CPE)range: < 18.8.0-r6
- (no CPE)range: < 18.9.0-r4
- (no CPE)range: < 0
- (no CPE)range: < 2.14.3-r3
- (no CPE)range: < 11.6.13-r2
- (no CPE)range: < 12.1.9-r2
- (no CPE)range: < 12.2.7-r2
- (no CPE)range: < 12.3.5-r2
- (no CPE)range: < 12.4.1-r2
- (no CPE)range: < 1.14.1-r2
- (no CPE)range: < 1.14.1-r2
- (no CPE)range: < 3.6.0-r1
- (no CPE)range: < 11.6.13-r4
- (no CPE)range: < 12.1.9-r4
- (no CPE)range: < 12.2.7-r2
- (no CPE)range: < 12.3.5-r3
- (no CPE)range: < 12.4.2-r0
- (no CPE)range: < 2.7.12-r15
- (no CPE)range: < 2.96.0-r2
- (no CPE)range: < 1.35.2.1-r2
- (no CPE)range: < 1.31.6.1-r15
- (no CPE)range: < 1.32.13.1-r6
- (no CPE)range: < 1.33.9.1-r4
- (no CPE)range: < 1.35.2.1-r2
- (no CPE)range: < 1.31.6.1-r15
- (no CPE)range: < 1.32.13.1-r6
- (no CPE)range: < 1.33.9.1-r4
- (no CPE)range: < 0.4.30-r4
- (no CPE)range: < 1.10.7-r5
- (no CPE)range: < 1.10.7-r6
- (no CPE)range: < 1.10.7-r5
- (no CPE)range: < 1.10.7-r6
- (no CPE)range: < 0.60.0-r4
- (no CPE)range: < 2.9.17-r5
- (no CPE)range: < 2.9.17-r5
- (no CPE)range: < 2.9.17-r5
- (no CPE)range: < 2.9.17-r5
- (no CPE)range: < 3.4.6-r10
- (no CPE)range: < 3.4.6-r10
- (no CPE)range: < 3.5.12-r1
- (no CPE)range: < 3.5.12-r1
- (no CPE)range: < 3.6.7-r4
- (no CPE)range: < 3.6.7-r4
- (no CPE)range: < 2.9.17-r6
- (no CPE)range: < 2.9.17-r6
- (no CPE)range: < 2.9.17-r6
- (no CPE)range: < 2.9.17-r6
- (no CPE)range: < 3.4.6-r9
- (no CPE)range: < 3.4.6-r9
- (no CPE)range: < 3.5.12-r2
- (no CPE)range: < 3.5.12-r2
- (no CPE)range: < 3.6.7-r4
- (no CPE)range: < 3.6.7-r4
- (no CPE)range: < 1.21.3-r1
- (no CPE)range: < 0.6.0-r11
- (no CPE)range: < 0.11.3-r5
- (no CPE)range: < 0.11.3-r2
- (no CPE)range: < 0.20251015.172955-r10
- (no CPE)range: < 0.20251015.172955-r11
- (no CPE)range: < 0
- (no CPE)range: < 2.45.2-r3
- (no CPE)range: < 3.7.1-r3
- (no CPE)range: < 0.18.2-r1
- (no CPE)range: < 0.18.2-r1
- (no CPE)range: < 0.148.0-r1
- (no CPE)range: < 0.148.0-r3
- (no CPE)range: < 0.148.0-r2
- (no CPE)range: < 0
- (no CPE)range: < 3.10.0-r3
- (no CPE)range: < 3.10.0-r2
- (no CPE)range: < 1.73.2-r2
- (no CPE)range: < 1.73.3-r0
- (no CPE)range: < 25.1.12-r8
- (no CPE)range: < 25.2.14-r4
- (no CPE)range: < 25.3.10-r3
- (no CPE)range: < 18.7.2-r4
- (no CPE)range: < 18.6.8-r7
- (no CPE)range: < 2.10.3-r6
- (no CPE)range: < 2.10.3-r6
- (no CPE)range: < 2.10.3-r6
- (no CPE)range: < 2.9.1-r3
- (no CPE)range: < 2.9.1-r3
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.10.3-r2
- (no CPE)range: < 2.9.1-r3
- (no CPE)range: < 2.9.1-r3
- (no CPE)range: < 0.4.0-r3
- (no CPE)range: < 0.99.5-r1
- (no CPE)range: < 0.99.4-r6
- (no CPE)range: < 0.32.1-r7
- (no CPE)range: < 0.32.1-r7
- (no CPE)range: < 0.32.1-r7
- (no CPE)range: < 1.36.6-r1
- (no CPE)range: < 0.10.2-r15
- (no CPE)range: < 1.35.0-r7
- (no CPE)range: < 1.35.0-r7
- (no CPE)range: < 0.20.2-r0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 7.74.1-r11
- (no CPE)range: < 7.76.3-r3
- (no CPE)range: < 25.3.0-r3
- (no CPE)range: < 0.224.0-r7
- (no CPE)range: < 18.7.2-r10
- (no CPE)range: < 18.8.0-r5
- (no CPE)range: < 18.9.0-r4
- (no CPE)range: < 18.7.2-r10
- (no CPE)range: < 18.8.0-r5
- (no CPE)range: < 18.9.0-r4
- (no CPE)range: < 2.14.3-r3
- (no CPE)range: < 11.6.13-r2
- (no CPE)range: < 12.1.9-r2
- (no CPE)range: < 12.2.7-r2
- (no CPE)range: < 12.3.5-r2
- (no CPE)range: < 12.4.1-r2
- (no CPE)range: < 1.14.1-r2
- (no CPE)range: < 2.7.12-r15
- (no CPE)range: < 1.35.2.1-r2
- (no CPE)range: < 1.32.13.1-r6
- (no CPE)range: < 1.33.9.1-r4
- (no CPE)range: < 1.35.2.1-r2
- (no CPE)range: < 1.32.13.1-r6
- (no CPE)range: < 1.33.9.1-r4
- (no CPE)range: < 0.4.30-r4
- (no CPE)range: < 1.10.7-r5
- (no CPE)range: < 1.10.7-r5
- (no CPE)range: < 0.60.0-r4
- (no CPE)range: < 3.4.6-r10
- (no CPE)range: < 3.4.6-r10
- (no CPE)range: < 3.5.12-r1
- (no CPE)range: < 3.5.12-r1
- (no CPE)range: < 3.6.7-r4
- (no CPE)range: < 3.6.7-r4
- (no CPE)range: < 1.21.3-r1
- (no CPE)range: < 0.6.0-r11
- (no CPE)range: < 0.11.3-r5
- (no CPE)range: < 0.20251015.172955-r10
- (no CPE)range: < 0
- (no CPE)range: < 2.45.2-r3
- (no CPE)range: < 3.7.1-r3
- (no CPE)range: < 0.18.2-r1
- (no CPE)range: < 0.148.0-r1
- (no CPE)range: < 0.148.0-r3
- (no CPE)range: < 3.10.0-r3
- (no CPE)range: < 1.73.2-r2
- (no CPE)range: < 25.3.10-r3
- (no CPE)range: < 18.7.2-r4
- (no CPE)range: < 18.6.8-r7
- (no CPE)range: < 2.10.3-r6
- (no CPE)range: < 2.10.3-r6
- (no CPE)range: < 2.10.3-r6
- (no CPE)range: < 0.4.0-r3
- (no CPE)range: < 0.99.5-r1
- (no CPE)range: < 0.32.1-r7
- (no CPE)range: < 0.32.1-r7
- (no CPE)range: < 0.32.1-r7
- (no CPE)range: < 1.36.6-r1
- (no CPE)range: < 0.10.2-r15
- (no CPE)range: < 1.1.2
- (no CPE)range: < 0.0.20260326T203309-150000.1.155.2
- (no CPE)range: < 0.34.0-1.1

Patches

Vulnerability mechanics

References

securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-6g7g-w4f8-9c9xghsaADVISORY
github.com/buger/jsonparser/issues/275nvdIssue TrackingThird Party AdvisoryWEB
github.com/golang/vulndb/issues/4514nvdIssue TrackingThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-32285ghsaADVISORY
pkg.go.dev/vuln/GO-2026-4514nvdThird Party AdvisoryWEB
github.com/buger/jsonparser/commit/a69e7e01cd4ad67bdfd3ac2c080b9212af16f4b0ghsaWEB
github.com/buger/jsonparser/pull/276ghsaWEB
github.com/buger/jsonparser/releases/tag/v1.1.2ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000