Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
HIGH severity

CVE-2026-120194 — Red Hat

HIGH

CVE-2026-120194 is a high-severity (CVSS 7.5) CWE-835 vulnerability. No vendor fix is recorded yet; mitigation options are listed below.

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that…

Published
Updated
Affected
—
Patched
—
Exploits
None indexed
Exploitation data as of Oct 31, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Description

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

Detection & mitigation playbook

Vulnerability

  1. Detect

    Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

  2. Remediation status

    No fixed release is recorded for CVE-2026-120194 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.

  3. Mitigate without a patch

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This issue is rated Important. A remote attacker who can supply a crafted JSONPath expression to an application that evaluates it with json-glib's json_path_query() (or equivalent compile-and-match APIs) can trigger a non-terminating loop in the slice evaluator (for example $[:5:-1]), causing a denial of service.…

Workaround published by Red Hat
Do not evaluate untrusted JSONPath expressions with json_path_query() or json_path_compile()/json_path_match() until a fix is available. Prefer fixed, application-defined path expressions. In particular, reject or avoid slice expressions that specify a negative step.
Source: Red Hat security advisory for CVE-2026-120194 (CC BY 4.0)

Frequently Asked Questions

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
O3 Security · Impact-Aware SCA

Is CVE-2026-120194 in your dependencies?

Find it across , including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-120194: Red Hat (High 7.5)