github.com/buger/jsonparser vulnerability

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

Published 26 Mar 2026Updated 7 Sep 202622 sources
CVSS 7.5 ✓ VERIFIED REFERENCE

What happened

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

Affected versions

github.com/buger/jsonparser: before 1.1.2 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

  • Apply vendor-provided updates or mitigations.
  • Review affected product exposure and access logs.

Public PoC references

RepositoryAuthorFirst seenReference
securityinfinity.comNVD reference2026-03-26Verified