Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/buger/jsonparser

3 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
v1.6.1 (Jul 30, 2026): no advisory affects it
Newest unaffected release
v1.6.1 (Jul 30, 2026), the latest release
Advisories
3 · 1 high
Releases
12 since v1.0.0 (May 10, 2020)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • Denial of service in github.com/buger/jsonparser

    Affected: fixed in 1.1.2; fixed in 1.1.2.

    Fixed in v1.1.2 (released Mar 19, 2026, 7 days before disclosure).

    The latest release, v1.6.1, is not affected.

  • jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.

    Affected: fixed in 1.1.1.

    Fixed in v1.1.1 (released Jan 8, 2021, 24 days after disclosure).

    The latest release, v1.6.1, is not affected.

  • The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.

    Affected: fixed in 1.0.0.

    Fixed in v1.0.0 (released May 10, 2020, 52 days after disclosure).

    The latest release, v1.6.1, is not affected.