Denial of service in GJSON

HOCH 7.5CVE-2020-35380 · GHSA-w942-gw6m-p62c · GO-2021-0059 · Published 15/12/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-35380 ist eine Schwachstelle (HOCH (CVSS 7.5)) in github.com/tidwall/gjson, gjson (gjson project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.5%, höher als bei 73.7% aller Schwachstellen.
Abhilfe: auf 1.6.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/tidwall/gjson Go	`< 1.6.4`	`1.6.4`
gjson gjson_project	`< 1.6.4`	`1.6.4`

Description

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON. Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.

NVD description

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.

References

nvd.nist.gov/vuln/detail/CVE-2020-35380 · ADVISORY
tidwall/gjson · WEB
tidwall/gjson commit f0ee9eb · WEB
tidwall/gjson · PACKAGE
pkg.go.dev/vuln/GO-2021-0059 · WEB

Weitere Schwachstellen in github.com/tidwall/gjson

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free