CVE catalog

CVE-2020-36325

jansson: CVE-2020-36325

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.72% · Oct 25, 2026

A flaw was found in jansson. An out-of-bounds read-access bug is possible due to a parsing error in json_loads. The highest threat from this vulnerability is do system availability. jansson: out-of-bounds read in json_loads() due to a parsing error A CVE was incorrectly assigned for this issue, which was a problem in the fuzzer code and not in the jansson library itself. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
DebianjanssonbookwormNot reportedvulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjansson4]Affected

    Source package: [jansson]

    Details (2)

    • 2.14-2 · amd64 · bookworm

      Affected

      dsa · jansson · debian · bookworm

    • 2.14-2 · arm64 · bookworm

      Affected

      dsa · jansson · debian · bookworm

  • [libjansson-dev]Affected

    Source package: [jansson]

    Details (2)

    • 2.14-2 · amd64 · bookworm

      Affected

      dsa · jansson · debian · bookworm

    • 2.14-2 · arm64 · bookworm

      Affected

      dsa · jansson · debian · bookworm

  • [libjansson-doc]Affected

    Source package: [jansson]

    Details (2)

    • 2.14-2 · all · bookworm

      Affected

      dsa · jansson · debian · bookworm

    • 2.14-2 · all · bookworm

      Affected

      dsa · jansson · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]