CVE-2026-120194

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

This issue is rated Important. A remote attacker who can supply a crafted JSONPath expression to an application that evaluates it with json-glib's json_path_query() (or equivalent compile-and-match APIs) can trigger a non-terminating loop in the slice evaluator (for example $[:5:-1]), causing a denial of service. Applications that only use fixed, application-defined JSONPath expressions are not exposed. No confidentiality or integrity impact has been demonstrated. No fixed upstream release is available yet; all currently shipped Red Hat and Fedora json-glib builds that include the JSONPath slice evaluator contain the vulnerable loop.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not evaluate untrusted JSONPath expressions with json_path_query() or json_path_compile()/json_path_match() until a fix is available. Prefer fixed, application-defined path expressions. In particular, reject or avoid slice expressions that specify a negative step.