CVE-2021-42836

github.com/tidwall/gjson Vulnerable to REDoS attack

7.5 HighFix available

GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.42%Up 0.9 points since Oct 23, 2021

What each source reports

NVD Score used 7.5

GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Record: CVE-2021-42836
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-400
Updated: 2026-11-02

CVE List No score

GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Record: CVE-2021-42836
Updated: 2026-11-02

EUVDEUVD-2021-2240 No score

GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Record: EUVD-2021-2240
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ppj4-34rq-v8j9 7.5

github.com/tidwall/gjson Vulnerable to REDoS attack

GJSON is a Go package that provides a fast and simple way to get values from a json document. GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Record: GHSA-ppj4-34rq-v8j9
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-697, CWE-1333
Updated: 2026-11-02

OSV 7.5

GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Record: CVE-2021-42836
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-42836 7.5

GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Record: DEBIAN-CVE-2021-42836
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-c9gm-7rfj-8w5h 7.5

Duplicate Advisory: ReDoS via crafted JSON input in GJSON

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-ppj4-34rq-v8j9. This link is maintained to preserve external references.

Original Description

GJSON <= 1.9.2 allows attackers to cause a redos via crafted JSON input.

Record: GHSA-c9gm-7rfj-8w5h
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-1333
Updated: 2026-11-02

OSVGHSA-ppj4-34rq-v8j9 7.5

github.com/tidwall/gjson Vulnerable to REDoS attack

GJSON is a Go package that provides a fast and simple way to get values from a json document. GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Record: GHSA-ppj4-34rq-v8j9
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-1333, CWE-400, CWE-697
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-42836 7.5

GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Record: UBUNTU-CVE-2021-42836
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGO-2021-0265 No score

Denial of service via maliciously crafted path in github.com/tidwall/gjson

A maliciously crafted path can cause Get and other query functions to consume excessive amounts of CPU and time.

Record: GO-2021-0265
Updated: 2026-11-02

Affected products

gjson project gjson

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/tidwall/gjson` Go	before 1.9.3	1.9.3
`golang-github-tidwall-gjson` Debian:12	before 1.14.4-2	1.14.4-2
`golang-github-tidwall-gjson` Debian:13	before 1.14.4-2	1.14.4-2
`golang-github-tidwall-gjson` Debian:14	before 1.14.4-2	1.14.4-2
`github.com/tidwall/gjson` Go From an advisory covering 2 CVEs	before 1.9.3	1.9.3
`golang-github-tidwall-gjson` Ubuntu:20.04:LTS	All versions, plus listed versions 1.1.5-2	None known
`golang-github-tidwall-gjson` Ubuntu:22.04:LTS	All versions, plus listed versions 1.6.7-1	None known
`golang-github-tidwall-gjson` Ubuntu:24.04:LTS	All versions, plus listed versions 1.14.4-21.17.1-1	None known
`golang-github-tidwall-gjson` Ubuntu:25.10	All versions, plus listed versions 1.17.1-1	None known
`golang-github-tidwall-gjson` Ubuntu:26.10	All versions, plus listed versions 1.17.1-11.19.0-1	None known
`golang-github-tidwall-gjson` Ubuntu:26.04:LTS	All versions, plus listed versions 1.17.1-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-42836 is a high vulnerability (CVSS 7.5) in Gjson Project Gjson, published October 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in github.com/tidwall/gjson 1.9.3.

References

Show 7 moreShow less