DEBIAN-CVE-2026-120194: High severity debian/json-glib vulnerability

Published Oct 31, 2026

Updated

A flaw was found in json-glib. The JSONPath slice evaluator used by jsonpathquery() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

Affected Software

3 affected components

debian/json-glib*

Event History

Oct 31, 2026

CVE Published

via OSV·10:16 AM

Data Sourced

via OSV·10:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are exposed to this denial of service?

Applications using json-glib are exposed if they pass attacker-controlled JSONPath expressions to json_path_query(). The issue can cause the application to hang.

What must an attacker provide to trigger the issue?

An attacker needs to supply a JSONPath slice expression with a negative step that is evaluated by json_path_query(). No authentication or user interaction is required according to the supplied severity vector.

What can be done if an update cannot be applied immediately?

Avoid evaluating untrusted JSONPath expressions, or reject slice expressions that use a negative step before passing them to json_path_query().

DEBIAN-CVE-2026-120194: High severity debian/json-glib vulnerability

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this denial of service?

What must an attacker provide to trigger the issue?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this denial of service?

What must an attacker provide to trigger the issue?

What can be done if an update cannot be applied immediately?