x/vulndb: potential Go vuln in github.com/buger/jsonparser: GHSA-6g7g-w4f8-9c9x

[GoVulnBot]

Advisory GHSA-6g7g-w4f8-9c9x references a vulnerability in the following Go modules:

Module
github.com/buger/jsonparser

Description:
The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

References:

• ADVISORY: GHSA-6g7g-w4f8-9c9x
• REPORT: Panic in Delete() via slice bounds out of range [-1:] on malformed input (v1.1.1) buger/jsonparser#275
• REPORT: x/vulndb: potential Go vuln in github.com/buger/jsonparser #4514
• WEB: https://cyber.securityinfinity.com/buger-jsonparser-negative-slice-panic-dos-2026

Cross references:

• github.com/buger/jsonparser appears in 3 other report(s):
  • data/reports/GO-2021-0057.yaml (dummy issue #57)
  • data/reports/GO-2021-0089.yaml (dummy issue #89)
  • data/reports/GO-2026-4514.yaml (x/vulndb: potential Go vuln in github.com/buger/jsonparser #4514)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/buger/jsonparser
      vulnerable_at: 1.1.1
summary: Denial of service in github.com/buger/jsonparser
ghsas:
    - GHSA-6g7g-w4f8-9c9x
references:
    - advisory: https://github.com/advisories/GHSA-6g7g-w4f8-9c9x
    - report: https://github.com/buger/jsonparser/issues/275
    - report: https://github.com/golang/vulndb/issues/4514
    - web: https://cyber.securityinfinity.com/buger-jsonparser-negative-slice-panic-dos-2026
source:
    id: GHSA-6g7g-w4f8-9c9x
    created: 2026-03-18T13:01:54.616750494Z
review_status: UNREVIEWED

[zaidsasa]

Fixed in buger/jsonparser#276
Version 1.1.2 https://github.com/buger/jsonparser/releases/tag/v1.1.2

[gopherbot]

Change https://go.dev/cl/760420 mentions this issue: data/reports: add 8 reports