CVE-2021-42836: Input Validation
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
Other sources
GJSON is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted JSON, a remote attacker could exploit this vulnerability to cause a regular expression denial of service.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-42836?
CVE-2021-42836 is a vulnerability in the GJSON package for Go that allows a ReDoS attack.
How does CVE-2021-42836 affect me?
If you are using GJSON version 1.9.3 or earlier, your application may be vulnerable to a ReDoS attack.
How severe is CVE-2021-42836?
CVE-2021-42836 has a severity rating of 7.5, which is considered high.
How can I fix CVE-2021-42836?
To fix CVE-2021-42836, upgrade to GJSON version 1.9.3 or later.
Where can I find more information about CVE-2021-42836?
You can find more information about CVE-2021-42836 on the NIST National Vulnerability Database and the GitHub issues for GJSON.