The Delete function in the jsonparser Go library incorrectly handles offset values when parsing malformed JSON, allowing a negative slice index that triggers a runtime panic. This panic terminates the program, resulting in a denial of service. The faulty logic stems from improper input validation associated with CWE-1285.

All releases of github.com/buger/jsonparser prior to the published fix are affected. Projects that embed the Delete function and accept untrusted JSON may be vulnerable. Based on the description, it is inferred that all releases before the fix are affected, and the exact version range is not specified in the advisory, so users should refer to the library’s release notes for the patched version.

The vulnerability has a CVSS base score of 7.5, indicating high impact. EPSS score is less than 1%, suggesting low probability of exploitation. It is not listed in the CISA KEV catalog. The faulty Delete function can be triggered by supplying crafted malformed JSON to any interface that uses the function. Based on the description, it is inferred that an attacker could cause a crash without needing elevated privileges.