CVE-2018-14632: JSON-Patch Out-of-bounds Write vulnerability in github.com/evanphx/json-patch
Summary
CVE-2018-14632: JSON-Patch Out-of-bounds Write vulnerability. Affects github.com/evanphx/json-patch across 2 version ranges.
< 0.5.2
>= 3.0.0, < 3.0.1-0.20180525145409-4c9aadca8f89
Fixed in 0.5.2 or 3.0.1-0.20180525145409-4c9aadca8f89, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/evanphx/json-patch is a Go library that provides functionality for applying JSON patches. It is commonly used in applications that require JSON patching capabilities. This vulnerability affects versions before 0.5.2 and 3.0.1-0.20180525145409-4c9aadca8f89 of the package.
Vulnerability Detail
An out-of-bounds write vulnerability exists in the oc patch functionality of OpenShift Container Platform before 3.7. This vulnerability allows an attacker to cause a denial of service attack on the Openshift master API service, which is responsible for cluster management. By exploiting this flaw, an attacker can manipulate the JSON patch data to write beyond the intended boundaries, leading to a crash or other unexpected behavior.
How To Fix
Latest published version: v0.5.2 as of 23 Oct 2026
go get github.com/evanphx/json-patch@v0.5.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.5.20.5.2go get github.com/evanphx/json-patch@v0.5.2 -
>= 3.0.0, < 3.0.1-0.20180525145409-4c9aadca8f893.0.1-0.20180525145409-4c9aadca8f89go get github.com/evanphx/json-patch@v3.0.1-0.20180525145409-4c9aadca8f89
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of the package.
Conclusion
The JSON-Patch Out-of-bounds Write vulnerability in github.com/evanphx/json-patch can be fixed by upgrading to the patched versions of the package. It is recommended to apply the fix as soon as possible to prevent potential denial of service attacks on the Openshift master API service. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/evanphx/json-patch →
FAQ
This vulnerability allows an attacker to cause a denial of service attack on the Openshift master API service, potentially disrupting cluster management.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground and it will alert you in real-time if your application is vulnerable.
There are no known public exploits for this vulnerability at the time of writing. However, it is always recommended to apply security patches as soon as they are available.
Yes, this vulnerability can be exploited remotely by sending a specially crafted JSON patch to the Openshift master API service.
Yes, the CVSS score for this vulnerability is 7.7, indicating a high severity.
