Cloudanix VulnDB

CVE-2026-120194

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Oct 31, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A common data-handling component can freeze applications when given certain specially crafted requests, potentially interrupting services that rely on it.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The JSONPath slice evaluator in json_path_query() enters an infinite loop on slice expressions containing a negative step value, preventing the function from returning and consuming CPU indefinitely.

Why it matters to the business

Services that accept attacker-controlled JSONPath queries can be forced into a hung state, causing denial of service and operational disruption until the affected process is restarted.

How an attack unfolds

An attacker identifies an application endpoint or API that passes user input directly to json_path_query(), submits a JSONPath slice expression with a negative step such as [0:10:-1], and triggers the infinite loop that hangs the worker or service thread.

How to fix it

Upgrade json-glib to a patched release that correctly validates or rejects negative step values in slice expressions. As a defense-in-depth measure, sanitize or reject untrusted JSONPath input before calling json_path_query().

How to confirm the fix worked

Replay known negative-step slice expressions against updated library builds and confirm that json_path_query() returns promptly without entering a loop; monitor library changelogs for the fix.

Typical attack path

  1. Locate an application surface accepting JSONPath expressions via json_path_query()
  2. Craft a slice expression containing a negative step value
  3. Submit the expression through the input channel
  4. Observe sustained high CPU or unresponsive behavior in the target process

How to detect it

Review application logs and process traces for calls to json_path_query() that never complete, high CPU threads stuck in JSONPath evaluation, or inbound requests containing JSONPath slice syntax with negative step indicators.

  • json_path_query
  • slice expression with negative step
  • [0:10:-1]
  • [-1:0:-1]

What your security team should do

  • Prioritize upgrading json-glib in all affected deployments given the one-day publication window
  • Add input validation or whitelisting around any use of json_path_query()
  • Restrict or disable JSONPath query features that accept untrusted expressions until patched

The record

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities