CVE-2020-36066: 
Linux Debian vulnerability analysis and mitigation

GJSON versions prior to 1.6.5 contain a denial of service vulnerability that allows attackers to cause a remote denial of service condition through crafted JSON input. The vulnerability was discovered and disclosed on December 23, 2020 (MITRE CVE, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue exists in the gjson.Get function which can enter a denial of service condition when processing specially crafted JSON input (NVD).

When successfully exploited, this vulnerability allows remote attackers to cause a denial of service condition, making the affected system unresponsive. The vulnerability affects the availability of the system while confidentiality and integrity remain unaffected (NVD).

The vulnerability can be triggered remotely without requiring authentication or user interaction. A proof of concept exploit has been publicly disclosed demonstrating how maliciously crafted JSON input can cause a denial of service condition (GitHub Issue).

Users should upgrade to GJSON version 1.6.5 or later which contains fixes for this vulnerability (MITRE CVE).