Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
Only affects json-glib 1.10.8 applications that evaluate untrusted JSONPath expressions containing a slice with a negative step. No fixed upstream release is available yet.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
json-glib, a library for parsing and generating JSON, is affected when its json_path_query() function processes a JSONPath slice expression with a negative step. This can cause the application to hang indefinitely if it evaluates attacker-supplied JSONPath expressions, resulting in a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- json-glib
Version range not reported
- json-glib
Version range not reported
- json-glib
Version range not reported
- json-glib
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
References 3
access.redhat.com
bugzilla.redhat.com
gitlab.gnome.org
Questions about CVE-2026-120194
What does this mean?
In json-glib, json_path_query() can enter a loop that never ends when a JSONPath slice has a negative step and a start index less than its end index. The application then hangs, which is a denial of service.Source: gitlab.gnome.org, bugzilla.redhat.com, access.redhat.com
Am I affected, and how do I check?
The confirmed affected version is JSON-GLib 1.10.8. To check the installed version, run pkg-config --modversion json-glib-1.0 or look at the version your package manager reports for json-glib. The bug only applies where the application evaluates an untrusted or attacker-controlled JSONPath expression through the vulnerable API.Source: gitlab.gnome.org, bugzilla.redhat.com, access.redhat.com
What should I do about it?
No fixed upstream release is available yet, so there is no upgrade target to move to. Until a fix is released, use the workaround: avoid evaluating untrusted JSONPath expressions, and reject or avoid slice expressions with a negative step.Source: gitlab.gnome.org, bugzilla.redhat.com, access.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
Avoid evaluating untrusted JSONPath expressions with json_path_query(). Where that is not possible, reject or avoid slice expressions that use a negative step.Source: gitlab.gnome.org, bugzilla.redhat.com, access.redhat.com