CVE-2020-36067 - GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call

HIGH

GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call

Published Jan 5, 2021

7.5

HIGH

CVSS 3.1

EPSS 1.40%

GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.

Ecosystem	Package	Introduced	Fixed
Go	github.com/tidwall/gjson	0	1.6.6

No remediation recorded yet.

Weaknesses (1)

CWE-129

Link	Providers	Tags
https://github.com/advisories/GHSA-p64j-r5f4-pwwx		Advisory
https://github.com/tidwall/gjson/commit/bf4efcb3c18d1825b2988603dea5909140a5302b
https://github.com/tidwall/gjson/issues/196		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-36067
https://pkg.go.dev/vuln/GO-2021-0054

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Jan 5, 2021

Updated Aug 4, 2024

Reserved Jan 4, 2021

Updated n/a

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a