CVE-2020-35381

Denial of Service in jsonparser

7.5 HighFix available

jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.31%Up 1.3 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.

Record: CVE-2020-35381
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Updated: 2026-11-02

CVE List No score

jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.

Record: CVE-2020-35381
Updated: 2026-11-02

EUVDEUVD-2022-3245 No score

jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.

Record: EUVD-2022-3245
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8vrw-m3j9-j27c 7.5

Denial of Service in jsonparser

jsonparser before 1.1.1 allows attackers to cause a denial of service via a GET call.

Record: GHSA-8vrw-m3j9-j27c
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 7.5

jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.

Record: CVE-2020-35381
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-35381 7.5

jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.

Record: DEBIAN-CVE-2020-35381
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-8vrw-m3j9-j27c 7.5

Denial of Service in jsonparser

jsonparser before 1.1.1 allows attackers to cause a denial of service via a GET call.

Record: GHSA-8vrw-m3j9-j27c
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-35381 7.5

jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.

Record: UBUNTU-CVE-2020-35381
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGO-2021-0057 No score

Panic due to improper input validation in github.com/buger/jsonparser

Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.

Record: GO-2021-0057
Updated: 2026-11-02

OSVROOT-APP-GOBINARY-CVE-2020-35381 No score

CVE-2020-35381 in github.com/buger/jsonparser - Patched by Root

Root has patched CVE-2020-35381 in the github.com/buger/jsonparser package for Root:Go. Multiple fixed versions available.

Record: ROOT-APP-GOBINARY-CVE-2020-35381
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/buger/jsonparser` Go	before 1.1.1	1.1.1
`golang-github-buger-jsonparser` Debian:12	before 1.1.1-1	1.1.1-1
`golang-github-buger-jsonparser` Debian:13	before 1.1.1-1	1.1.1-1
`golang-github-buger-jsonparser` Debian:14	before 1.1.1-1	1.1.1-1
`github.com/buger/jsonparser` Root:Go	before v1.1.1-aikido.4	v1.1.1-aikido.4
`rootio-github.com/buger/jsonparser` Root:Go	before v1.1.1-root.io.4	v1.1.1-root.io.4
`golang-github-buger-jsonparser` Ubuntu:18.04:LTS	All versions, plus listed versions 0.0~git20170705.0.9addec9-1	None known
`golang-github-buger-jsonparser` Ubuntu:20.04:LTS	All versions, plus listed versions 0.0~git20170705.0.9addec9-2	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-35381 is a high vulnerability (CVSS 7.5) in Jsonparser Project Jsonparser, published December 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.31%, the 83rd percentile. Fixed in github.com/buger/jsonparser 1.1.1.

References

Show 8 moreShow less