CVE-2020-10675: Infinite loop in github.com/buger/jsonparser
Summary
CVE-2020-10675: Infinite loop in github.com/buger/jsonparser. Affects github.com/buger/jsonparser versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Also tracked for
- golang-github-buger-jsonparser · Debian:11
The same CVE-2020-10675 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/buger/jsonparser, which is a Go library for parsing JSON data. It provides efficient and flexible methods for extracting values from JSON documents. However, a vulnerability has been identified in the library that can lead to an infinite loop when parsing malformed JSON. This vulnerability can be exploited as a denial of service vector, particularly when operating on untrusted user input.
Vulnerability Detail
The vulnerability arises when parsing JSON that contains opening brackets but lacks closing brackets. This triggers an infinite loop in the jsonparser library. As a result, if an application processes such malformed JSON, it can get stuck in an infinite loop, consuming excessive resources and causing a denial of service. This vulnerability can be particularly dangerous when handling untrusted user input, as an attacker can intentionally send malformed JSON to disrupt the application's functionality.
How To Fix
Latest published version: v1.6.1 as of 22 Oct 2026
go get github.com/buger/jsonparser@v1.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
go get github.com/buger/jsonparser@v1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can implement input validation and sanitization techniques to ensure that only well-formed JSON is processed by the application. This can help mitigate the risk of encountering malformed JSON and triggering the infinite loop issue.
Conclusion
In conclusion, the github.com/buger/jsonparser library is vulnerable to an infinite loop issue when parsing malformed JSON. This can be exploited as a denial of service vector, particularly when handling untrusted user input. To mitigate this vulnerability, developers should update to version 1.0.0 or higher of the library. Additionally, implementing input validation and sanitization techniques can help reduce the risk of encountering malformed JSON. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/buger/jsonparser →
FAQ
The impact of this vulnerability is a denial of service, where an application can get stuck in an infinite loop and consume excessive resources. This can lead to degraded performance or even a complete system outage.
Yes, this vulnerability can be exploited remotely. An attacker can send specially crafted malformed JSON to the application, triggering the infinite loop and causing a denial of service.
There are no known public exploits available for this vulnerability at the moment. However, it is always recommended to promptly apply security patches and updates to mitigate the risk.
No, only versions prior to 1.0.0 are affected by this vulnerability. Developers should ensure they are using version 1.0.0 or higher to avoid the infinite loop issue.
There are several alternative JSON parsing libraries available in the Go ecosystem, such as encoding/json and jsoniter. Developers can consider using these libraries as alternatives to github.com/buger/jsonparser if they prefer to avoid the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/buger/jsonparser.
