Denial of service in GJSON

ALTO 7.5CVE-2020-35380 · GHSA-w942-gw6m-p62c · GO-2021-0059 · Published 15/12/2020 · updated 17/06/2026

In breve

CVE-2020-35380 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/tidwall/gjson, gjson (gjson project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.5%, superiore al 73.7% delle vulnerabilità.
Correzione: aggiornare a 1.6.4 o successiva.

Package	Affected versions	Patched versions
github.com/tidwall/gjson Go	`< 1.6.4`	`1.6.4`
gjson gjson_project	`< 1.6.4`	`1.6.4`

Description

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON. Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.

NVD description

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.

References

nvd.nist.gov/vuln/detail/CVE-2020-35380 · ADVISORY
tidwall/gjson · WEB
tidwall/gjson commit f0ee9eb · WEB
tidwall/gjson · PACKAGE
pkg.go.dev/vuln/GO-2021-0059 · WEB

Altre vulnerabilità di github.com/tidwall/gjson

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free