json-glib CVE-2026-120194

The exploitable condition is explicit in the description: the embedding application must evaluate ATTACKER-CONTROLLED JSONPath expressions via json_path_query(), and the attacker must supply a slice expression containing a NEGATIVE STEP to trigger the infinite loop. The key limiting factor is that applications using only fixed, developer-authored, or otherwise trusted JSONPath expressions are not exposed, because the attacker never controls the query string. Impact is confined to availability (a hang/CPU exhaustion); there is no data disclosure or modification. Authentication is not confirmed from the data as a requirement - the CVSS vector lists PR:N, but whether a real attacker is unauthenticated depends on how the embedding application exposes JSONPath input.

The input signals are consistent in direction but modest in urgency. CVSS 3.1 scores this 7.5 (High) driven entirely by availability impact (A:H) with no confidentiality or integrity effect, over a network vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N). The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a pure denial-of-service bug. No EPSS score, no CISA KEV listing, and no proof-of-concept exploit code are present in the supplied data, so this is not confirmed as actively exploited. The headline CVSS network/unauthenticated rating is real for the library flaw itself, but it materially overstates practical risk for most deployments: exploitation requires the embedding application to pass ATTACKER-CONTROLLED JSONPath expressions to json_path_query(), which is an uncommon design. Where that condition is NOT met (the typical case, where JSONPath queries are hard-coded or trusted), the network vector does not actually apply to an external attacker. Net: a legitimate High-severity availability bug worth patching on a normal cadence, but not a widespread drop-everything emergency absent evidence of exploitation.

An application exposes a feature that lets users supply JSONPath expressions (e.g., a query/filter API backed by json-glib) and evaluates them with json_path_query(). An attacker submits a slice expression using a negative step, causing the slice evaluator to enter an infinite loop that pins a CPU and hangs the worker/thread, denying service to legitimate users. No public exploit code is identified in the provided sources; the GNOME GitLab issue and Red Hat Bugzilla document the flaw but are not verified working exploits.