CVE-2020-35380: Denial of Service in GJSON
Summary
CVE-2020-35380: Denial of service in GJSON. Affects github.com/tidwall/gjson versions < 1.6.4. Fixed in 1.6.4. How to fix ↓
Also tracked for
- golang-github-tidwall-gjson · Debian:11
The same CVE-2020-35380 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GJSON is a Go package that provides a fast and easy way to extract values from JSON documents. It is commonly used in Go applications for parsing and manipulating JSON data. However, versions before 1.6.4 of GJSON are vulnerable to a denial of service attack. This vulnerability arises from improper bounds checking during JSON parsing, allowing maliciously crafted JSON objects to trigger an out-of-bounds panic. If an application parses user input using GJSON, an attacker can exploit this vulnerability to cause a denial of service, potentially impacting the availability of the application.
Vulnerability Detail
The vulnerability (CVE-2020-35380) in GJSON before version 1.6.4 allows attackers to cause a denial of service by providing crafted JSON input. The issue originates from improper bounds checking during JSON parsing, leading to an out-of-bounds panic. By exploiting this vulnerability, an attacker can send specially crafted JSON objects that trigger the out-of-bounds panic, causing the application to crash or become unresponsive. This can be used as a vector for denial of service attacks, impacting the availability of the affected application.
How To Fix
Latest published version: v1.20.0 as of 23 Oct 2026
go get github.com/tidwall/gjson@v1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.4
This is the first release that contains the fix.
go get github.com/tidwall/gjson@v1.6.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional input validation and sanitization measures to mitigate the risk of this vulnerability. This can involve validating JSON input for correctness and ensuring it adheres to expected formats and structures. By implementing strict input validation, developers can reduce the likelihood of encountering maliciously crafted JSON that triggers the vulnerability.
Conclusion
In conclusion, the GJSON package before version 1.6.4 is vulnerable to a denial of service attack due to improper bounds checking during JSON parsing. This can be exploited by providing crafted JSON input, leading to an out-of-bounds panic and potential application crashes or unresponsiveness. To mitigate this vulnerability, it is crucial to update to GJSON version 1.6.4 or later and implement proper input validation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tidwall/gjson →
FAQ
This vulnerability allows attackers to cause a denial of service by exploiting improper bounds checking during JSON parsing. It can lead to application crashes or unresponsiveness, impacting the availability of the affected application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is still crucial to address the issue promptly by updating to the fixed version of GJSON.
If your application is affected by this vulnerability, it is recommended to update the GJSON package to version 1.6.4 or later. Additionally, consider implementing input validation and sanitization measures to further mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tidwall/gjson.
