github.com/tidwall/gjson (Go)
Get JSON values quickly - JSON parser for Go
Advisories
10
Latest version
v1.20.0
Released Oct 5, 2026
License
MIT
OpenSSF Scorecard
2.9 / 10
How to fix
Upgrading to 1.9.3 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/tidwall/gjson@v1.20.0 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GO-2022-0592 A maliciously crafted path can cause Get and other query functions to consume excessive amounts of CPU and time. Withdrawn |
Not rated yet | < 1.9.3 | 1.9.3 |
| GHSA-ppj4-34rq-v8j9 Duplicate Advisory: ReDoS via crafted JSON input in GJSON |
High EPSS 2.42% |
< 1.9.3 | 1.9.3 |
| GHSA-ppj4-34rq-v8j9 Duplicate Advisory: ReDoS via crafted JSON input in GJSON |
High EPSS 2.42% |
< 1.9.3 | 1.9.3 |
| GHSA-ppj4-34rq-v8j9 Duplicate Advisory: ReDoS via crafted JSON input in GJSON |
High EPSS 2.42% |
< 1.9.3 | 1.9.3 |
| GHSA-p64j-r5f4-pwwx Improper Validation of Array Index in GJSON |
High EPSS 1.40% |
< 1.6.6 | 1.6.6 |
| GHSA-p64j-r5f4-pwwx Improper Validation of Array Index in GJSON |
High EPSS 1.40% |
< 1.6.6 | 1.6.6 |
| GHSA-wjm3-fq3r-5x46 github.com/tidwall/gjson is vulnerable to Denial of service |
High EPSS 1.84% |
< 1.6.5 | 1.6.5 |
| GHSA-wjm3-fq3r-5x46 github.com/tidwall/gjson is vulnerable to Denial of service |
High EPSS 1.84% |
< 1.6.5 | 1.6.5 |
| GHSA-w942-gw6m-p62c Denial of service in GJSON |
High EPSS 1.69% |
< 1.6.4 | 1.6.4 |
| GHSA-w942-gw6m-p62c Denial of service in GJSON |
High EPSS 1.69% |
< 1.6.4 | 1.6.4 |
Source: https://github.com/tidwall/gjson
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor