Denial of Service Vulnerability in github.com/buger/jsonparser
Summary
GHSA-6g7g-w4f8-9c9x: Denial of service in github.com/buger/jsonparser. Affects github.com/buger/jsonparser versions < 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/buger/jsonparser package is a Go library designed for fast JSON parsing. It is widely used in applications that require efficient handling of JSON data. However, the package has a vulnerability that arises from improper validation of offsets in its Delete function, which can lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability originates from the Delete function within the jsonparser package, which fails to adequately validate offsets when processing malformed JSON input. This oversight can result in a negative slice index, causing a runtime panic. Such a situation can be exploited to launch a denial of service attack, rendering the application unusable. The vulnerability affects versions from 0.0.0 up to 1.1.1, making it critical for users of this package to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation in your application to ensure that only well-formed JSON is processed. This can help mitigate the risk of triggering the vulnerability until an update is applied.
Conclusion
The denial of service vulnerability in the github.com/buger/jsonparser package poses a significant risk to applications that utilize it. Users are strongly advised to update to a patched version to mitigate potential attacks. Implementing input validation can serve as a temporary measure until the update is completed.
See every vulnerability recorded for github.com/buger/jsonparser →
FAQ
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
Versions from 0.0.0 up to 1.1.1 of the jsonparser package are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to a denial of service, causing your application to crash or become unresponsive.
Yes, updating to a version beyond 1.1.1 will patch the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/buger/jsonparser.
