CVE-2020-36067: Improper Validation of Array Index in GJSON
Summary
CVE-2020-36067: Improper Validation of Array Index in GJSON. Affects github.com/tidwall/gjson versions < 1.6.6. Fixed in 1.6.6. How to fix ↓
Also tracked for
- golang-github-tidwall-gjson · Debian:11
The same CVE-2020-36067 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/tidwall/gjson, which is a Go library that provides a fast and easy way to access JSON values. It allows users to extract values from JSON documents using a simple query syntax. The package is widely used in various Go applications for JSON parsing and manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2020-36067, exists in versions of GJSON prior to 1.6.6. It stems from improper validation of array indexes, leading to a denial of service (DoS) condition. Attackers can exploit this vulnerability by crafting a malicious GET call, causing a panic and resulting in a runtime error: 'slice bounds out of range'. This vulnerability has a CVSS score of 7.5, indicating a high severity level. The impact of this vulnerability can disrupt the availability of affected applications, potentially leading to service outages or crashes.
How To Fix
Latest published version: v1.20.0 as of 23 Oct 2026
go get github.com/tidwall/gjson@v1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.6
This is the first release that contains the fix.
go get github.com/tidwall/gjson@v1.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can implement additional input validation checks before using the GJSON library. By ensuring that the input is within the expected range of array indexes, the vulnerability can be mitigated. Here's an example of how to perform input validation for array indexes in Go:
func validateArrayIndex(index int, arrayLength int) bool {
return index >= 0 && index < arrayLength
}
Conclusion
In conclusion, the vulnerability CVE-2020-36067 in the GJSON package can be exploited by attackers to cause a denial of service condition. To mitigate this vulnerability, it is crucial to upgrade to GJSON version 1.6.6 or later. Additionally, implementing input validation checks can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/tidwall/gjson →
FAQ
GJSON is a Go library that provides a simple and efficient way to access JSON values. It allows developers to extract data from JSON documents using a query syntax.
The vulnerability can lead to a denial of service (DoS) condition, causing a panic and runtime error. This can result in service disruptions or crashes in affected applications.
To fix this vulnerability, it is recommended to upgrade the GJSON package to version 1.6.6 or later. This version includes the necessary fixes to address the array index validation issue.
Yes, developers can implement additional input validation checks before using the GJSON library. By ensuring that the input is within the expected range of array indexes, the vulnerability can be mitigated.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/tidwall/gjson.
