GNOME json-glib Infinite Loop Denial of Service Vulnerability (CVE-2026-120194) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTApplications and systems utilizing the GNOME json-glib library to evaluate user-controlled JSONPath queries via json_path_query()
An attacker can trigger an infinite loop by supplying a JSONPath slice expression with a negative step, leading to 100% CPU utilization and a complete Denial of Service (DoS)
Upgrade the json-glib package to the latest patched version, or implement input validation to reject JSONPath expressions containing negative slice steps
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the json-glib package to the latest security-patched version provided by your operating system vendor.
# For Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get install --only-upgrade -y libjson-glib-1.0-0
# For RHEL/CentOS/Rocky Linux-based systems
sudo dnf clean all && sudo dnf upgrade -y json-glib2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, implement input validation at the application layer to sanitize and reject any JSONPath queries containing negative step values.
# Example Python middleware validation snippet
import re
def secure_filter_jsonpath(query_string):
# Detect negative step patterns in JSONPath slices (e.g., ':-1' or ': -2')
pattern = re.compile(r':[\s]*-([0-9]+)')
if pattern.search(query_string):
return False # Reject the query
return True3. Log Audit & IoC Verification Commands
Use the following commands to check the installed version of json-glib and monitor for high CPU utilization caused by potential exploitation attempts.
# Verify the installed version of json-glib on the system
ldconfig -p | grep json-glib
# Monitor for processes consuming excessive CPU resources
top -b -n 1 | head -n 20Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A critical flaw has been identified in json-glib, a widely used library for parsing and handling JSON data within GNOME environments and various Linux applications. The vulnerability resides in the JSONPath slice evaluator used by the json_path_query() function. When processing a slice expression that contains a negative step value, the evaluator fails to properly handle the decrementing index boundaries, resulting in an infinite loop (CWE-835: Loop with Unreachable Exit Condition).
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability if the target application accepts and evaluates arbitrary JSONPath expressions from untrusted sources. By crafting a payload containing a negative step in a slice expression (e.g., $.data[-1:-10:-2]), the attacker forces the json-glib parser into an infinite loop. Because the loop control variable never satisfies the termination condition, the thread handling the request consumes 100% of the allocated CPU core. Repeated requests can easily exhaust all available CPU resources on the host, rendering the entire application or container unresponsive.
3. Infrastructure & Business Impact
Since json-glib is a core dependency in many Linux distributions (including Red Hat Enterprise Linux, Fedora, Debian, and Ubuntu), this vulnerability poses a significant risk to infrastructure stability. A successful Denial of Service (DoS) attack can disrupt critical business APIs, microservices, and desktop environments, leading to service downtime and potential SLA breaches without requiring any prior authentication.
Official Vendor Advisories & References
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
Frequently Asked SecOps Questions (CVE-2026-120194)
FAQQ1. How critical is CVE-2026-120194 and is it actively exploited in the wild?
CVE-2026-120194 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 0.5%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120194?
Primary impacted vendors include gnome, redhat across json-glib. Scope summary: All unpatched versions of the GNOME json-glib library
Q3. What temporary mitigations or workarounds exist for CVE-2026-120194 before patching?
[Mitigation] Upgrade the json-glib package to the latest patched version, or implement input validation to reject JSONPath expressions containing negative slice steps Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120194
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gnome)
View Category →GNOME Epiphany Browser Permission Bypass and Unauthorized Camera/Microphone Access Vulnerability (CVE-2026-118598)
[Affected Scope] GNOME Epiphany browser versions 45.0 through at least 51.x
GNOME Epiphany Browser WebExtension Installation Arbitrary File Overwrite Vulnerability (CVE-2026-118599)
[Affected Scope] GNOME Epiphany browser versions 47.0 and above
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.