CVE-2020-36067: Panic due to improper input validation in github.com/tidwall/gjson
Summary
CVE-2020-36067: Panic due to improper input validation in ForEach in github.com/tidwall/gjson. Affects github.com/tidwall/gjson versions < 1.6.6. Fixed in 1.6.6. How to fix ↓
Also tracked for
- golang-github-tidwall-gjson · Debian:11
The same CVE-2020-36067 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/tidwall/gjson is a Go library that provides a fast and simple way to parse JSON data. It allows users to extract values from JSON documents using a simple query syntax. The package is widely used in Go applications for JSON parsing and manipulation.
Vulnerability Detail
The vulnerability (CVE-2020-36067) in github.com/tidwall/gjson arises from improper input validation. Maliciously crafted JSON objects can trigger an out-of-bounds panic due to inadequate bounds checking. If an application uses this package to parse user input, an attacker can exploit this vulnerability to cause a denial of service (DoS) attack. The impact of this vulnerability can be severe, as it can lead to application crashes and unavailability.
How To Fix
Latest published version: v1.20.0 as of 23 Oct 2026
go get github.com/tidwall/gjson@v1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.6
This is the first release that contains the fix.
go get github.com/tidwall/gjson@v1.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible.
Conclusion
The vulnerability (CVE-2020-36067) in github.com/tidwall/gjson can be exploited to cause a denial of service (DoS) attack. It is crucial for developers to update their applications to use version 1.6.6 or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tidwall/gjson →
FAQ
The vulnerability can be exploited to cause a denial of service (DoS) attack by triggering an out-of-bounds panic. This can lead to application crashes and unavailability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your Gopkg.lock file and alerts you in real-time for open-source vulnerabilities.
No, there is no known workaround. It is essential to update to the fixed version of the package.
There are no known public exploits for this vulnerability at the moment.
This vulnerability was discovered by @toptotu.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tidwall/gjson.
