CVE-2021-42836

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944Patch, Third Party Advisory
https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96Patch, Third Party Advisory
https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3Release Notes, Third Party Advisory
https://github.com/tidwall/gjson/issues/236Exploit, Issue Tracking, Third Party Advisory
https://github.com/tidwall/gjson/issues/237Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944Patch, Third Party Advisory
https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96Patch, Third Party Advisory
https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3Release Notes, Third Party Advisory
https://github.com/tidwall/gjson/issues/236Exploit, Issue Tracking, Third Party Advisory
https://github.com/tidwall/gjson/issues/237Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Oct 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-428379.8An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on CVE-2021-428386.1Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated at CVE-2021-428398.8Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remot CVE-2021-42846.1A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x. This affects CVE-2021-428408.8SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin CVE-2021-428416.1Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker c CVE-2021-428479.8Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.CVE-2021-428485.3An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user CVE-2021-428496.8A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device CVE-2021-42856.1A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templ CVE-2021-428507.8A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that CVE-2021-428515.3A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard use