Medium
Security advisory
Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-36429
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:42 UTC · Revision 1
Source evidence
Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth.
osv:CVE-2020-36429
Complete source record
{
"id": "87e885974d24f65d2ed8f59bb71763b7cead90d8ed15802c154907ce4071e2b0",
"url": "https://osv.dev/vulnerability/CVE-2020-36429",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-36429",
"summary": "Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth.",
"evidence": "osv:CVE-2020-36429",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-36429",
"aliases": [
"CVE-2020-36429"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/open62541/open62541",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "bbcafda57e0f9b116282caa0b2f1613a647fdf41"
},
{
"fixed": "c800e2987b10bb3af6ef644b515b5d6392f8861d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:open62541:open62541:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.4"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "c800e2987b10bb3af6ef644b515b5d6392f8861d"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v1.0.3",
"v1.0.2",
"v1.1-rc1",
"v1.0.1",
"basic256sha256",
"v1.0",
"v1.1-dev",
"v1.0-dev",
"v1.0-rc5",
"v1.0-rc4",
"v1.0-rc3",
"v1.0-rc2",
"v1.0-rc1",
"v0.2.0-RC1",
"v0.1.0-RC4",
"v0.1.0-RC1",
"v0.0.0-150309",
"v0.1-automation14"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36429.json",
"vanir_signatures": [
{
"id": "CVE-2020-36429-1aeb97a7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115589657386106373776704950080852287639",
"72213354066418414053447635445112365438",
"270371368738623723701133046383624322599",
"211192699312422201934058028310031790212",
"254864359012564443531894779692685339449",
"248550733685918923564808838620017666843",
"156588293583800433783138200494190673901",
"270861131005614166768126533835242346364"
]
},
"source": "https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41",
"target": {
"file": "tests/client/check_client_subscriptions.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-1f8a4737",
"digest": {
"length": 4479,
"function_hash": "63854338184991855252613874003967313659"
},
"source": "https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41",
"target": {
"file": "tests/server/check_monitoreditem_filter.c",
"function": "START_TEST"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-37619012",
"digest": {
"length": 103,
"function_hash": "232446076123946135939645049094528348619"
},
"source": "https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d",
"target": {
"file": "src/ua_types_encoding_json.c",
"function": "WRITE_JSON_ELEMENT"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-37a6c280",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171631696095424329346436366443886636998",
"272371987468136198303504430640267534088",
"41651417264788631989536296745307507863",
"146125882410948464231169559352572729682",
"79258880184109319744536849159801851589",
"110773983660757024916406908294012925234",
"315196480013959386955217912480205957286",
"59143138413461554673486238737972647993",
"313031388964376238057255606389540038695",
"258887258245297293481235993744954412239",
"154525276088346484581746907004982550150",
"65893383398946068036395934877970587871",
"166200861673191900426096274928761095609",
"111613222338900123914035625887012827749",
"212328624759505596178946986462604797459",
"32585414257997715982589634038667265986",
"65888083066455135333620260266115770296",
"74594884956477849238008365469026643026",
"112503441126355109026216273973930545205"
]
},
"source": "https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d",
"target": {
"file": "src/ua_types_encoding_json.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-50ad522a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224889299355584025446619959480715776276",
"264054749762672212824798558781619940695",
"198593888313889155010665775680533909407",
"169242569489537818486753452640465918534",
"60586231308582091037844097483103360473",
"58161754816400689276415710266121313386",
"110496932840850632625640381819834581486",
"338638674044717033268135978782349500319"
]
},
"source": "https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41",
"target": {
"file": "src/server/ua_services_monitoreditem.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-5380ffb2",
"digest": {
"length": 1134,
"function_hash": "145510635280143188610133439636619391386"
},
"source": "https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d",
"target": {
"file": "src/ua_types_encoding_json.c",
"function": "encodeJsonStructure"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-7444b49f",
"digest": {
"length": 2993,
"function_hash": "170385770136586855406604395212551369755"
},
"source": "https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41",
"target": {
"file": "src/server/ua_services_monitoreditem.c",
"function": "setMonitoredItemSettings"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-8c7af3b8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"98037667602601648763692738518846730433",
"6106152355615157746761373841797358085",
"17920930091431751174794816459234782021",
"143866613621403870474324361082888010680",
"140573504339808468579646715352164329202",
"163993583185190598686679050455975829809",
"322128091398597945300506032964974682736",
"106451411340306678521904229355778838487",
"270124503129145029557153848468341779661",
"23909921224290225916775711479823525097",
"214683164817757644215784446974863098747",
"216674851366731272436320140516114503959",
"165688662646001298680832162729546396484"
]
},
"source": "https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41",
"target": {
"file": "tests/server/check_monitoreditem_filter.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-9b8a5c53",
"digest": {
"length": 768,
"function_hash": "16905178019275247773709815027505232738"
},
"source": "https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d",
"target": {
"file": "src/ua_types_encoding_json.c",
"function": "addMultiArrayContentJSON"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-bf40e120",
"digest": {
"length": 4145,
"function_hash": "14495690100003541217647390526211191256"
},
"source": "https://github.com/open62541/open62541/commit/bbcafda57e0f9b116282caa0b2f1613a647fdf41",
"target": {
"file": "tests/client/check_client_subscriptions.c",
"function": "START_TEST"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-bffd06dd",
"digest": {
"length": 118,
"function_hash": "50955694977577986011033256783286303446"
},
"source": "https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d",
"target": {
"file": "src/ua_types_encoding_json.c",
"function": "WRITE_JSON_ELEMENT"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-36429-e2ecc049",
"digest": {
"length": 1346,
"function_hash": "276114975370014126614951229178890591802"
},
"source": "https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d",
"target": {
"file": "src/ua_types_encoding_json.c",
"function": "decodeJsonStructure"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:14:10Z"
}
}
],
"modified": "2026-10-20T14:14:10.604772627Z",
"provider": "osv",
"references": [
"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/open62541/OSV-2020-153.yaml",
"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20578",
"https://github.com/open62541/open62541/commit/c800e2987b10bb3af6ef644b515b5d6392f8861d",
"https://github.com/open62541/open62541/compare/v1.0.3...v1.0.4"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-36429",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388755,
"published_at": "2021-07-20T07:15:07.773+00:00"
}