CVE-2021-42836: Regular Expression Denial of Service in gjson
Summary
CVE-2021-42248: github.com/tidwall/gjson Vulnerable to REDoS attack. Affects github.com/tidwall/gjson versions < 1.9.3. Fixed in 1.9.3. How to fix ↓
Also tracked for
- golang-github-tidwall-gjson · Debian:11
The same CVE-2021-42248 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GJSON is a Go package that provides a fast and simple way to get values from a JSON document. It is commonly used in Go applications for parsing and extracting data from JSON files. However, versions of GJSON before 1.9.3 are vulnerable to a regular expression denial of service (ReDoS) attack. This means that an attacker can craft a malicious JSON document that, when processed by GJSON, causes the application to consume excessive CPU resources and potentially become unresponsive.
Vulnerability Detail
The vulnerability in GJSON arises from a lack of proper input validation when processing regular expressions. An attacker can exploit this by providing a specially crafted JSON document with a malicious regular expression pattern. When GJSON attempts to match this pattern against the JSON data, the regular expression engine can enter into an exponential-time matching algorithm, leading to a denial of service condition. This can result in the application becoming unresponsive or crashing, potentially impacting the availability of the system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: v1.20.0 as of 23 Oct 2026
go get github.com/tidwall/gjson@v1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.3
This is the first release that contains the fix.
go get github.com/tidwall/gjson@v1.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of GJSON is not immediately feasible, a temporary workaround is to implement input validation and limit the complexity of regular expressions used with GJSON. This can be achieved by carefully reviewing the regular expressions in the application and ensuring they are not susceptible to exponential-time matching algorithms. Additionally, it is recommended to sanitize and validate any user-supplied JSON data before processing it with GJSON.
Conclusion
In conclusion, the vulnerability in GJSON allows for a regular expression denial of service attack, which can lead to application unresponsiveness and potential system crashes. It is crucial to upgrade to GJSON version 1.9.3 or later to mitigate this vulnerability. Implementing input validation and limiting the complexity of regular expressions can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tidwall/gjson →
FAQ
GJSON is a Go package that provides a fast and simple way to extract values from JSON documents. It is commonly used in Go applications for parsing and manipulating JSON data.
A regular expression denial of service (ReDoS) attack is a type of vulnerability where an attacker can craft a malicious input that causes a regular expression engine to enter into an exponential-time matching algorithm. This can lead to excessive CPU usage and potentially denial of service.
The potential consequences of this vulnerability include application unresponsiveness, increased CPU usage, and potential system crashes. This can impact the availability and performance of the affected system.
To mitigate this vulnerability, it is recommended to upgrade to GJSON version 1.9.3 or later. Additionally, implementing input validation and limiting the complexity of regular expressions used with GJSON can provide temporary mitigation.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, including this one in GJSON.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tidwall/gjson.
