The Delete function in buger/jsonparser fails to properly validate offsets when parsing malformed JSON input, which can result in a negative slice index and trigger a runtime panic. This crash leads to an application denial of service, disrupting normal operation without providing any additional access or persistent impact to the system.

The vulnerable component is the buger/jsonparser library used in Go applications that parse JSON data. All versions in use before the issue is addressed are potentially affected; the vulnerability is reported in the library’s public repository and does not reference a specific version, so any deployment that relies on this package should be considered at risk.

The attack vector is likely remote via crafted JSON payloads sent to an application that employs the Delete function, which does not apply bounds checks on the offsets. While the exploit requires sending malformed input rather than advanced privilege escalation, the resulting crash can cause significant downtime. The vulnerability is not currently listed in the CISA KEV catalog and no EPSS score is available, suggesting that coverage may be limited but the risk remains high due to the ease of triggering the panic.