github.com/tidwall/gjson (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/tidwall/gjson, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2020-35380 — CVSS 7.5 (high): GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
• CVE-2020-36066 — CVSS 7.5 (high): GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.
• CVE-2020-36067 — CVSS 7.5 (high): GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
• CVE-2021-42836 — CVSS 7.5 (high): GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
• CVE-2021-42248: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42836. Reason: This candidate is a duplicate of CVE-2021-42836…