CVE-2026-32285: 
NixOS vulnerability analysis and mitigation

CVE-2026-32285 is a denial-of-service vulnerability in the buger/jsonparser Go library (v1.1.1) caused by improper validation of array indices in the Delete() function. When processing malformed JSON input, the function computes a negative offset at parser.go:729 and uses it directly as a slice index without a lower-bound check, triggering a runtime panic. The vulnerability affects all versions of github.com/buger/jsonparser prior to v1.1.2 and was disclosed on March 26, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, GitHub Issue #275).

The root cause is classified as CWE-129 (Improper Validation of Array Index). In parser.go at line 729, the Delete() function computes an offset from malformed JSON input that can resolve to -1, which is then used as a slice index without any lower-bound validation, causing an immediate Go runtime panic (slice bounds out of range [-1:]). This is distinct from the previously patched CVE-2020-10675, which was an infinite loop in the same function — the current flaw affects a separate code path not covered by that earlier fix. A minimal crashing input is documented as data=""0":"0":" with key="0", requiring no authentication or special privileges to trigger (GitHub Issue #275, Go VulnDB #4514).

Successful exploitation crashes any Go service that calls Delete() on untrusted JSON input, resulting in a complete loss of availability for the affected process. Because the panic is unrecoverable without explicit panic-handling middleware, a single malformed HTTP request is sufficient to bring down a service. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition (GitHub Issue #275, Feedly).

No weaponized exploit code or in-the-wild exploitation has been confirmed; the Feedly intelligence classifies the referenced advisory page as containing no actionable exploit code or reproduction steps. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, exploitation requires only network access and no authentication, making it trivially easy to attempt against exposed services (Feedly, Go VulnDB #4514).

1. Reconnaissance: Identify services that use github.com/buger/jsonparser v1.1.1 and expose endpoints that accept and process JSON input via the Delete() function (e.g., REST APIs, microservices).
2. Craft malformed JSON payload: Construct a minimal malformed JSON string known to trigger the negative offset, such as "0":"0": with a target key of "0", as documented in the vulnerability report.
3. Send the payload: Submit the crafted JSON as the body of an HTTP request (or other applicable input channel) to the target service endpoint that invokes Delete() on user-supplied data.
4. Trigger runtime panic: The Delete() function at parser.go:729 computes a -1 offset and attempts to use it as a slice index, causing an immediate Go runtime panic and crashing the service process.
5. Repeat for sustained DoS: Since no authentication is required, the attacker can repeatedly send the payload to prevent service recovery if the process is automatically restarted (GitHub Issue #275, Go VulnDB #4514).

• Logs: Go runtime panic messages in application logs containing panic: runtime error: slice bounds out of range [-1:] with a stack trace referencing github.com/buger/jsonparser.Delete(...) at parser.go:729.
• Network: Repeated HTTP requests to JSON-processing endpoints with malformed or structurally invalid JSON bodies (e.g., payloads like "0":"0": or similar patterns with mismatched delimiters).
• Process: Unexpected process crashes or restarts of Go-based services, particularly those that handle external JSON input; monitoring tools may show abnormal process exit codes associated with unhandled panics.

Upgrade github.com/buger/jsonparser to version 1.1.2 or later, which includes a fix for the negative slice index issue. As an interim workaround, services can implement Go recover()-based panic handlers around calls to Delete() to prevent process crashes, though this does not fix the underlying flaw. Additionally, input validation or JSON schema enforcement at the API boundary can reduce exposure by rejecting structurally malformed JSON before it reaches the library. Multiple downstream distributions including Amazon Linux 2, Amazon Linux 2023, Red Hat, openSUSE, and Fedora have issued advisories and updated packages (Go VulnDB #4514, AWS ALAS AL2, Red Hat Advisory).

The vulnerability was reported by security researcher athuljayaram via both the upstream buger/jsonparser GitHub issue tracker and the Go vulnerability database on February 19, 2026. The Go security team acknowledged the report and tracked it under GO-2026-4514. Multiple Linux distributions (Red Hat, openSUSE, Fedora, Amazon Linux) and container platforms (Portainer) have issued security advisories and updated packages, indicating broad downstream impact across the Go ecosystem (Go VulnDB #4514, Red Hat Advisory).