The vulnerable json-glib library contains a flaw in the JSONPath slice evaluator used by its json_path_query() function. When a slice expression with a negative step is processed, the evaluator can enter an infinite loop. An attacker who can supply malicious JSONPath expressions to an application that uses json_path_query() can force that application into a prolonged hang, effectively denying service to legitimate users.

Red Hat Enterprise Linux 7–10 and Red Hat OpenShift Container Platform 4 installations include the vulnerable json-glib library. All current releases of these platforms that contain the unpatched version of the library are affected, as no specific version exclusions are listed.

The CVSS score of 7.5 indicates a high impact with a potential for remote exploitation if an application accepts untrusted JSON input. Because the EPSS score is unavailable, there is no reported exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, the risk of current widespread exploitation is uncertain. The likely attack vector is remote, based on the ability of an attacker to supply a crafted JSONPath expression to a vulnerable application. Until a fix is deployed, the vulnerability remains a high-risk denial‑of‑service condition.