Denial of Service Vulnerability in github.com/buger/jsonparser
Summary
GO-2026-4514: Denial of service in github.com/buger/jsonparser. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The github.com/buger/jsonparser package is a Go library designed for parsing JSON data efficiently. It provides various functions to manipulate JSON structures, including the ability to delete elements from JSON objects. However, this package has been found to have a critical vulnerability that can lead to denial of service under certain conditions.
Vulnerability Detail
The vulnerability arises from the Delete function within the jsonparser package, which fails to properly validate offsets when processing malformed JSON input. This oversight can result in a negative slice index, leading to a runtime panic. Such a panic can crash the application, effectively causing a denial of service. Attackers can exploit this vulnerability by sending specially crafted JSON data, which can disrupt the normal operation of applications relying on this package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that the JSON data being processed is well-formed before passing it to the Delete function. This can help prevent malformed input from causing a panic. For example, you can use a JSON validation library to check the structure of the input before processing it.
Conclusion
The denial of service vulnerability in the github.com/buger/jsonparser package poses a significant risk to applications that utilize it. Proper validation of JSON input and timely updates to the package are crucial to mitigate this risk. Utilizing tools like Vulert can further enhance your ability to monitor and address vulnerabilities in your software.
See every vulnerability recorded for github.com/buger/jsonparser →
FAQ
The vulnerability is a denial of service issue caused by improper validation of offsets in the Delete function when handling malformed JSON.
An attacker can exploit this vulnerability by sending malformed JSON input to the application, causing it to crash due to a runtime panic.
Yes, updating to the latest version of the jsonparser package will resolve this vulnerability.
Implement input validation to ensure that only well-formed JSON is processed by the Delete function as a temporary workaround.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/buger/jsonparser.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
