GJSON prior to 1.6.4 allows malicious users to cause a denial of service via crafted JSON.
gjson project gjson