{"id":"CVE-2020-36429","details":"Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth.","modified":"2026-07-08T21:26:40.183565Z","published":"2021-07-20T07:15:07.773Z","references":[{"type":"ADVISORY","url":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/open62541/OSV-2020-153.yaml"},{"type":"FIX","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20578"},{"type":"FIX","url":"https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d"},{"type":"FIX","url":"https://github.com/open62541/open62541/compare/v1.0.3...v1.0.4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open62541/open62541","events":[{"introduced":"0"},{"fixed":"bbcafda57e0f9b116282caa0b2f1613a647fdf41"},{"fixed":"c800e2987b10bb3af6ef644b515b5d6392f8861d"}],"database_specific":{"cpe":"cpe:2.3:a:open62541:open62541:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.0.4"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.0.3","v1.0.2","v1.1-rc1","v1.0.1","basic256sha256","v1.0","v1.1-dev","v1.0-dev","v1.0-rc5","v1.0-rc4","v1.0-rc3","v1.0-rc2","v1.0-rc1","v0.2.0-RC1","v0.1.0-RC4","v0.1.0-RC1","v0.0.0-150309","v0.1-automation14"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36429.json","vanir_signatures_modified":"2026-07-08T21:26:40Z","vanir_signatures":[{"target":{"file":"tests/client/check_client_subscriptions.c"},"deprecated":false,"digest":{"line_hashes":["115589657386106373776704950080852287639","72213354066418414053447635445112365438","270371368738623723701133046383624322599","211192699312422201934058028310031790212","254864359012564443531894779692685339449","248550733685918923564808838620017666843","156588293583800433783138200494190673901","270861131005614166768126533835242346364"],"threshold":0.9},"id":"CVE-2020-36429-1aeb97a7","signature_type":"Line","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41"},{"deprecated":false,"digest":{"function_hash":"63854338184991855252613874003967313659","length":4479},"id":"CVE-2020-36429-1f8a4737","signature_type":"Function","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41","target":{"file":"tests/server/check_monitoreditem_filter.c","function":"START_TEST"}},{"target":{"file":"src/ua_types_encoding_json.c","function":"WRITE_JSON_ELEMENT"},"deprecated":false,"digest":{"function_hash":"232446076123946135939645049094528348619","length":103},"id":"CVE-2020-36429-37619012","signature_type":"Function","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["171631696095424329346436366443886636998","272371987468136198303504430640267534088","41651417264788631989536296745307507863","146125882410948464231169559352572729682","79258880184109319744536849159801851589","110773983660757024916406908294012925234","315196480013959386955217912480205957286","59143138413461554673486238737972647993","313031388964376238057255606389540038695","258887258245297293481235993744954412239","154525276088346484581746907004982550150","65893383398946068036395934877970587871","166200861673191900426096274928761095609","111613222338900123914035625887012827749","212328624759505596178946986462604797459","32585414257997715982589634038667265986","65888083066455135333620260266115770296","74594884956477849238008365469026643026","112503441126355109026216273973930545205"]},"id":"CVE-2020-36429-37a6c280","signature_type":"Line","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d","target":{"file":"src/ua_types_encoding_json.c"}},{"target":{"file":"src/server/ua_services_monitoreditem.c"},"deprecated":false,"digest":{"line_hashes":["224889299355584025446619959480715776276","264054749762672212824798558781619940695","198593888313889155010665775680533909407","169242569489537818486753452640465918534","60586231308582091037844097483103360473","58161754816400689276415710266121313386","110496932840850632625640381819834581486","338638674044717033268135978782349500319"],"threshold":0.9},"id":"CVE-2020-36429-50ad522a","signature_type":"Line","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41"},{"deprecated":false,"digest":{"function_hash":"145510635280143188610133439636619391386","length":1134},"id":"CVE-2020-36429-5380ffb2","signature_type":"Function","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d","target":{"file":"src/ua_types_encoding_json.c","function":"encodeJsonStructure"}},{"deprecated":false,"digest":{"function_hash":"170385770136586855406604395212551369755","length":2993},"id":"CVE-2020-36429-7444b49f","signature_type":"Function","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41","target":{"file":"src/server/ua_services_monitoreditem.c","function":"setMonitoredItemSettings"}},{"id":"CVE-2020-36429-8c7af3b8","signature_type":"Line","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41","target":{"file":"tests/server/check_monitoreditem_filter.c"},"deprecated":false,"digest":{"line_hashes":["98037667602601648763692738518846730433","6106152355615157746761373841797358085","17920930091431751174794816459234782021","143866613621403870474324361082888010680","140573504339808468579646715352164329202","163993583185190598686679050455975829809","322128091398597945300506032964974682736","106451411340306678521904229355778838487","270124503129145029557153848468341779661","23909921224290225916775711479823525097","214683164817757644215784446974863098747","216674851366731272436320140516114503959","165688662646001298680832162729546396484"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d","target":{"file":"src/ua_types_encoding_json.c","function":"addMultiArrayContentJSON"},"deprecated":false,"digest":{"function_hash":"16905178019275247773709815027505232738","length":768},"id":"CVE-2020-36429-9b8a5c53","signature_type":"Function"},{"target":{"file":"tests/client/check_client_subscriptions.c","function":"START_TEST"},"deprecated":false,"digest":{"function_hash":"14495690100003541217647390526211191256","length":4145},"id":"CVE-2020-36429-bf40e120","signature_type":"Function","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41"},{"digest":{"function_hash":"50955694977577986011033256783286303446","length":118},"id":"CVE-2020-36429-bffd06dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d","target":{"file":"src/ua_types_encoding_json.c","function":"WRITE_JSON_ELEMENT"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d","target":{"file":"src/ua_types_encoding_json.c","function":"decodeJsonStructure"},"deprecated":false,"digest":{"function_hash":"276114975370014126614951229178890591802","length":1346},"id":"CVE-2020-36429-e2ecc049"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}