CVE-2021-42248
Duplicate Advisory: ReDoS via crafted JSON input in GJSON
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42836. Reason: This candidate is a duplicate of CVE-2021-42836. Notes: All CVE users should reference CVE-2021-42836 instead of this candidate.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-c9gm-7rfj-8w5h
Duplicate Advisory: ReDoS via crafted JSON input in GJSON
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-ppj4-34rq-v8j9. This link is maintained to preserve external references.
Original Description
GJSON <= 1.9.2 allows attackers to cause a redos via crafted JSON input.
- Record
GHSA-c9gm-7rfj-8w5h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
CVE List No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42836. Reason: This candidate is a duplicate of CVE-2021-42836. Notes: All CVE users should reference CVE-2021-42836 instead of this candidate.
- Record
CVE-2021-42248- Updated
- 2026-11-02
EUVDEUVD-2022-3547
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42836. Reason: This candidate is a duplicate of CVE-2021-42836. Notes: All CVE users should reference CVE-2021-42836 instead of this candidate.
- Record
EUVD-2022-3547- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
NVD No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42836. Reason: This candidate is a duplicate of CVE-2021-42836. Notes: All CVE users should reference CVE-2021-42836 instead of this candidate.
- Record
CVE-2021-42248- Updated
- 2026-11-02
OSVCVE-2021-42836
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
- Record
CVE-2021-42836- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-c9gm-7rfj-8w5h
Duplicate Advisory: ReDoS via crafted JSON input in GJSON
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-ppj4-34rq-v8j9. This link is maintained to preserve external references.
Original Description
GJSON <= 1.9.2 allows attackers to cause a redos via crafted JSON input.
- Record
GHSA-c9gm-7rfj-8w5h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVGHSA-ppj4-34rq-v8j9
github.com/tidwall/gjson Vulnerable to REDoS attack
GJSON is a Go package that provides a fast and simple way to get values from a json document. GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
- Record
GHSA-ppj4-34rq-v8j9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400, CWE-697
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-42248
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-42836. Reason: This candidate is a duplicate of CVE-2021-42836. Notes: All CVE users should reference CVE-2021-42836 instead of this candidate.
- Record
UBUNTU-CVE-2021-42248- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGO-2021-0265 No score
Denial of service via maliciously crafted path in github.com/tidwall/gjson
A maliciously crafted path can cause Get and other query functions to consume excessive amounts of CPU and time.
- Record
GO-2021-0265- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/tidwall/gjsonGo From an advisory covering 2 CVEs |
before 1.9.3 | 1.9.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases, references | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-42248 has been rejected by its source and should not be treated as a live vulnerability, published October 22, 2021.