GitHub Advisoryadvisory · Go

GHSA-ppj4-34rq-v8j9 github.com/tidwall/gjson Vulnerable to REDoS attack

HIGH Published 2021-10-25 Modified 2024-05-20 Official page ↗
Aliases
CVE-2021-42836
Ecosystem
Go
Packages
github.com/tidwall/gjson
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400, CWE-697
Reviewed
2021-10-25

Affected packages

• Go github.com/tidwall/gjson: < 1.9.3 → fixed in 1.9.3

Description

GJSON is a Go package that provides a fast and simple way to get values from a json document. GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Related

Alias · CVE (1)

  • CVE-2021-42836 GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack. vulnerability

Weakness · CWE (3)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-697 Incorrect Comparison weakness

References