CVE-2020-35380
published 2020-12-15CVE-2020-35380: GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
PriorityP432high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.66%
74.2th percentile
GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | golang-github-tidwall-gjson | < golang-github-tidwall-gjson 1.6.7-1 (bookworm) | golang-github-tidwall-gjson 1.6.7-1 (bookworm) |
| github.com | tidwall_gjson | >= 0 < 1.6.4 | 1.6.4 |
| gjson_project | gjson | < 1.6.4 | 1.6.4 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Denial of service in GJSON
osv·2021-06-23
CVE-2020-35380 [HIGH] Denial of service in GJSON
Denial of service in GJSON
GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON. Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.
GHSA
Denial of service in GJSON
ghsa·2021-06-23
CVE-2020-35380 [HIGH] CWE-400 Denial of service in GJSON
Denial of service in GJSON
GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON. Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.
OSV
Panic due to improper input validation in Get in github.com/tidwall/gjson
osv·2021-04-14
CVE-2020-35380 Panic due to improper input validation in Get in github.com/tidwall/gjson
Panic due to improper input validation in Get in github.com/tidwall/gjson
Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.
OSV
CVE-2020-35380: GJSON before 1
osv·2020-12-15·CVSS 7.5
CVE-2020-35380 [HIGH] CVE-2020-35380: GJSON before 1
GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
Debian
CVE-2020-35380: golang-github-tidwall-gjson - GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSO...
vendor_debian·2020·CVSS 7.5
CVE-2020-35380 [HIGH] CVE-2020-35380: golang-github-tidwall-gjson - GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSO...
GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
Scope: local
bookworm: resolved (fixed in 1.6.7-1)
bullseye: resolved (fixed in 1.6.7-1)
forky: resolved (fixed in 1.6.7-1)
sid: resolved (fixed in 1.6.7-1)
trixie: resolved (fixed in 1.6.7-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-12-15
Published