Parsing malformed JSON which contain opening brackets, but not closing brackets, leads to an infinite loop. If operating on untrusted user input this can be used as a denial of service vector.
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2021-0089" }