CVE-2020-36066: Denial of Service in github.com/tidwall/gjson
Summary
CVE-2020-36066: github.com/tidwall/gjson is vulnerable to Denial of service. Affects github.com/tidwall/gjson versions < 1.6.5. Fixed in 1.6.5. How to fix ↓
Also tracked for
- golang-github-tidwall-gjson · Debian:11
The same CVE-2020-36066 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/tidwall/gjson package is a Go library that provides a fast and easy way to extract values from JSON documents. It is commonly used in Go applications for parsing and manipulating JSON data. However, versions prior to 1.6.5 of gjson are vulnerable to a Denial of Service (DoS) attack when processing crafted JSON payloads.
Vulnerability Detail
The vulnerability (CVE-2020-36066) in gjson allows attackers to cause a remote DoS attack by sending specially crafted JSON data. This vulnerability can be exploited by an attacker to consume excessive CPU resources, resulting in a denial of service for the affected application. The issue originates from improper handling of certain JSON structures by the gjson library.
How To Fix
Latest published version: v1.20.0 as of 23 Oct 2026
go get github.com/tidwall/gjson@v1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.5
This is the first release that contains the fix.
go get github.com/tidwall/gjson@v1.6.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the gjson package to the fixed version to mitigate the risk of a DoS attack.
Conclusion
The vulnerability in github.com/tidwall/gjson (CVE-2020-36066) allows attackers to perform a denial of service attack by sending specially crafted JSON data. To mitigate this risk, it is crucial to update the gjson package to version 1.6.5 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tidwall/gjson →
FAQ
The vulnerability allows attackers to cause a denial of service by sending specially crafted JSON data. This can lead to application downtime and unavailability.
To check if your application is affected, you can use the Vulert Playground at Vulert Scanner. It provides real-time monitoring and alerts for open-source vulnerabilities, including this one.
No, only versions prior to 1.6.5 of gjson are affected by this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
Yes, this vulnerability can be exploited remotely by sending crafted JSON data to the affected application.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tidwall/gjson.
