The vulnerability identified as CVE-2026-32285 affects the github.com/buger/jsonparser library used in Red Hat's multicluster engine for Kubernetes 2.8.6 and related Assisted Installer RHEL 9 components. Specifically, the Delete function fails to properly validate offsets when handling malformed JSON input, leading to a negative slice index and a runtime panic. This can be exploited remotely by an attacker supplying specially crafted JSON data to cause a denial of service (DoS) condition. Red Hat has not provided an official patch or fix for this issue, citing lack of suitable mitigation options that meet their criteria for ease of use, applicability, and stability. The advisory references multiple CVEs related to this issue and provides documentation links for the affected products. The vulnerability is classified under CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input).

The impact of this vulnerability is a denial of service caused by a runtime panic in the jsonparser library when processing malformed JSON input. This can disrupt the availability of the multicluster engine for Kubernetes and the Assisted Installer components that rely on it, potentially affecting centralized management of Kubernetes clusters. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

Currently, no official fix or patch is available from Red Hat for this vulnerability. Red Hat states that mitigation options either do not exist or do not meet their criteria for deployment due to complexity or stability concerns. Users are advised to monitor Red Hat advisories for updates and consider upgrading to future product versions once fixes become available. Customers with a Red Hat Technical Account Manager (TAM) can discuss this vulnerability directly with Red Hat for tailored guidance.