PT-2026-28436 · Go+9 · Go+15

Published 2026-03-16 · Updated 2026-05-21 · CVE-2026-32285

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2026

Description The Delete function does not correctly validate offsets when processing malformed JSON input. This can result in a negative slice index and a runtime panic, potentially leading to a denial of service attack.

Recommendations Ensure proper validation of offsets when processing JSON input for the Delete function.

Exploit

Fix

DoS

RCE

Out of bounds Read

Improper Validation of Array Index

Weakness Enumeration

CWE-20

CWE-125

CWE-129

Related Identifiers

BDU:2026-04782

CLEANSTART-2026-AP92343

CLEANSTART-2026-AQ65185

CLEANSTART-2026-BG69533

CLEANSTART-2026-DA99134

CLEANSTART-2026-DM19620

CLEANSTART-2026-DO31246

CLEANSTART-2026-FH54780

CLEANSTART-2026-HQ88036

CLEANSTART-2026-JY63371

CLEANSTART-2026-PM81907

CLEANSTART-2026-PY36202

CLEANSTART-2026-WA14162

CLEANSTART-2026-WA84208

CVE-2026-32285

GHSA-6G7G-W4F8-9C9X

GO-2026-4514

OPENSUSE-SU-2026:10731-1

RHSA-2026:7191

SUSE-SU-2026:1135-1

Affected Products

Go

Grafana Alloy

Red Hat Advanced Cluster Management For Kubernetes

Red Hat Openshift Container Platform

Red Hat Openshift Distributed Tracing

Red Hat Openstack Platform

Github.Com/Buger/Jsonparser

Golang-Github-Buger-Jsonparser

Govulncheck-Vulndb

Jsonparser

Mcphost

Prometheus

Rootio-Github.Com/Buger/Jsonparser

Tempo

Tempo-Fips

Terragrunt-Fips

References · 293

• 🔥 https://securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026 · Exploit
• https://osv.dev/vulnerability/CLEANSTART-2026-WA14162 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68121 · Security Note
• https://bdu.fstec.ru/vul/2026-04782 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-32285 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32285 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-HQ88036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39882 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25679 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-DM19620 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-WA84208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32285 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39825 · Security Note