CVE-2026-120194High· 7.5▾ TwilightA flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
json-glib (all versions)json-glib (all versions)json-glib (all versions)json-glib (all versions)openshift/ose-rhel-coreos-8 (all versions)openshift/ose-rhel-coreos-9 (all versions)openshift/ose-rhel-coreos-9 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Do not evaluate untrusted JSONPath expressions with json_path_query() or json_path_compile()/json_path_match() until a fix is available. Prefer fixed, application-defined path expressions. In particular, reject or avoid slice expressions that specify a negative step.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110931High· 7.5Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop
CVE-2026-107602High· 7.5Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop
CVE-2023-3255Medium· 6.5Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service
CVE-2026-101755Medium· 5.3mysql: mysql: Denial of Service via client programs (CVE-2026-101755)
CVE-2026-101776Medium· 4.9mysql: mysql: Denial of Service in Group Replication plugin (CVE-2026-101776)
CVE-2026-101787Medium· 4.9mysql: mysql: Denial of Service via Server Optimizer flaw (CVE-2026-101787)