{"id":"CVE-2020-10675","aliases":["DEBIAN-CVE-2020-10675","EUVD-2021-1184","GHSA-rmh2-65xw-9m6q","GO-2021-0089","UBUNTU-CVE-2020-10675"],"status":"published","title":"Infinite Loop in jsonparser","description":"The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02584,"percentile":0.85445,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2020-03-19T13:27:20Z","modified":"2026-10-26T12:00:14Z","fixes":[{"ecosystem":"Go","package":"github.com/buger/jsonparser","fixed_in":["1.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"golang-github-buger-jsonparser","fixed_in":["0.0~git20200322.0.f7e751e-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-buger-jsonparser","fixed_in":["0.0~git20200322.0.f7e751e-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-buger-jsonparser","fixed_in":["0.0~git20200322.0.f7e751e-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/buger/jsonparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-buger-jsonparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20200322.0.f7e751e-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-buger-jsonparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20200322.0.f7e751e-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-buger-jsonparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20200322.0.f7e751e-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/buger/jsonparser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/buger/jsonparser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-buger-jsonparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20170705.0.9addec9-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-buger-jsonparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20170705.0.9addec9-2"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jsonparser_project","product":"jsonparser"}],"references":[{"url":"https://github.com/buger/jsonparser/issues/188","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4C7PV6KEUUM76V4B2J5IFN2U6LEOWB67/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KUHKDQSEYJNROA66OMN6AAQMGAAN6WI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10675","tags":["advisory"]},{"url":"https://github.com/buger/jsonparser/pull/192","tags":["web","fix"]},{"url":"https://github.com/buger/jsonparser/commit/91ac96899e492584984ded0c8f9a08f10b473717","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0089","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4C7PV6KEUUM76V4B2J5IFN2U6LEOWB67","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6KUHKDQSEYJNROA66OMN6AAQMGAAN6WI","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rmh2-65xw-9m6q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-10675","tags":["advisory"]},{"url":"https://github.com/buger/jsonparser","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-10675","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10675","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-10675","description":"The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.","status":"published","published":"2020-03-19T13:27:20Z","modified":"2024-08-04T11:06:10.65Z","updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2021-1184","description":"The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.","status":"published","published":"2020-03-19T13:27:20Z","modified":"2024-08-04T11:06:10Z","updated_at":"2026-11-03T03:07:49.454544Z"}],"ghsa":[{"id":"GHSA-rmh2-65xw-9m6q","title":"Infinite Loop in jsonparser","description":"The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.","status":"published","published":"2021-05-18T18:26:25Z","modified":"2024-05-20T19:47:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2020-10675","description":"The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.","status":"published","published":"2020-03-19T14:15:12.287Z","modified":"2026-06-17T02:48:14.257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:05:56.580228Z"}],"osv":[{"id":"CVE-2020-10675","description":"The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.","status":"published","published":"2020-03-19T14:15:12.287Z","modified":"2026-10-20T10:51:45.103531231Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2020-10675","description":"The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.","status":"published","published":"2020-03-19T14:15:12.287Z","modified":"2026-10-26T12:00:14.586173926Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-rmh2-65xw-9m6q","title":"Infinite Loop in jsonparser","description":"The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.","status":"published","published":"2021-05-18T18:26:25Z","modified":"2024-05-20T19:47:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"UBUNTU-CVE-2020-10675","description":"The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.","status":"published","published":"2020-03-19T14:15:00Z","modified":"2025-10-24T04:48:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"GO-2021-0089","title":"Infinite loop in github.com/buger/jsonparser","description":"Parsing malformed JSON which contain opening brackets, but not closing brackets, leads to an infinite loop. If operating on untrusted user input this can be used as a denial of service vector.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}