CVE-2026-120194: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-120194 is a denial-of-service vulnerability in json-glib, a GNOME library for parsing and generating JSON data. The flaw exists in the JSONPath slice evaluator used by json_path_query(), which can enter an infinite loop when processing a slice expression with a negative step (e.g., $[:5:-1]). Affected products include json-glib as shipped in Red Hat Enterprise Linux and Red Hat OpenShift (RHEL CoreOS 8 and 9); no fixed upstream release was available at the time of disclosure. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The slice evaluator in json_path_query() iterates with a loop condition that assumes a positive step (i < end while adding step each iteration); when start is less than end and step is negative, the loop index moves away from the termination condition, causing a non-terminating loop (Red Hat Bugzilla). Exploitation requires only that an application pass attacker-controlled JSONPath expressions to the vulnerable API — no authentication or special privileges are needed. Applications that use only fixed, application-defined JSONPath expressions are not exposed (Red Hat Advisory).

Successful exploitation causes the affected application process to hang indefinitely, resulting in a complete denial of service for the availability of that service. There is no demonstrated confidentiality or integrity impact — the vulnerability is purely an availability issue. Any network-accessible service that evaluates user-supplied JSONPath expressions via json-glib's json_path_query() or the equivalent compile-and-match APIs is at risk, including applications running on Red Hat Enterprise Linux and OpenShift Container Platform (Red Hat Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The vulnerability is remotely exploitable with no authentication or user interaction required, lowering the bar for potential abuse. The EPSS score is reported as 0.0, reflecting the current absence of observed exploitation activity (ENISA EUVD). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Identify a target application: Locate a network-accessible service that uses json-glib's json_path_query() or json_path_compile()/json_path_match() APIs to evaluate user-supplied JSONPath expressions (e.g., a REST API or data processing service).
2. Craft a malicious JSONPath expression: Construct a slice expression with a negative step, such as $[:5:-1], which triggers the infinite loop condition in the slice evaluator.
3. Submit the payload: Send the crafted JSONPath expression to the target application via its normal input channel (e.g., an HTTP request body, query parameter, or API field that accepts JSONPath queries).
4. Trigger the hang: The application's call to json_path_query() enters a non-terminating loop, causing the process to consume CPU and hang indefinitely, making the service unavailable to legitimate users (Red Hat Bugzilla, Red Hat Advisory).

• Network: Repeated requests to application endpoints that accept JSONPath expressions, particularly containing slice syntax with negative step values (e.g., $[:5:-1] or similar patterns in request bodies or parameters.
• Process: Application processes consuming 100% CPU indefinitely without completing requests; worker threads or processes that become unresponsive and do not return results.
• Logs: Application logs showing requests that never complete or time out; absence of response log entries for requests that were received; upstream proxy or load balancer logs recording gateway timeouts (HTTP 504) from the affected service.
• System: Elevated CPU utilization on the host running the json-glib-dependent application with no corresponding increase in throughput or completed transactions.

No fixed upstream release of json-glib was available at the time of disclosure; Red Hat has rated this issue as Important and is working on patches for affected products (Red Hat Advisory). The primary workaround is to avoid evaluating untrusted JSONPath expressions with json_path_query() or json_path_compile()/json_path_match() — applications should use only fixed, application-defined path expressions. Where user input must be accepted, implement input validation to reject slice expressions containing a negative step before passing them to the API. Additionally, consider implementing request timeouts on JSONPath query operations to limit the impact of any hang, and restrict JSONPath evaluation to trusted inputs wherever feasible (Red Hat Advisory).

Red Hat classified the issue as Important severity and acknowledged the reporter, Avinash Hanwate, in their advisory (Red Hat Advisory). The vulnerability was noted on social platforms including Mastodon and Bluesky shortly after disclosure, reflecting routine community tracking of new CVEs rather than significant alarm. No major independent security researcher write-ups or vendor statements beyond Red Hat's advisory were identified at the time of this report.