Search
Find a vulnerability
Search criteria
6 vulnerabilities found for jawn by typelevel
CVE-2026-61814 (GCVE-0-2026-61814)
Vulnerability from nvd – Published: 2026-09-23 18:39 – Updated: 2026-09-23 19:41
VLAI
EPSS
VEX
Title
Jawn: Quadratic parsing effort in AsyncParser
Summary
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:25 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/typelevel/jawn/security/adviso… | x_refsource_CONFIRM |
| https://github.com/typelevel/jawn/commit/cddcd5e3… | x_refsource_MISC |
| https://github.com/typelevel/jawn/releases/tag/v1.7.0 | x_refsource_MISC |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| typelevel | jawn |
Affected:
< 1.7.0
|
|
| org.typelevel | jawn-parser_2.12 |
Affected:
< 1.7.0
|
|
| org.typelevel | jawn-parser_2.13 |
Affected:
< 1.7.0
|
|
| org.typelevel | jawn-parser_3 |
Affected:
< 1.7.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:25:56.569425Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:41:40.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jawn",
"vendor": "typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
},
{
"product": "jawn-parser_2.12",
"vendor": "org.typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
},
{
"product": "jawn-parser_2.13",
"vendor": "org.typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
},
{
"product": "jawn-parser_3",
"vendor": "org.typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jawn is an open source JSON parser. Prior to 1.7.0, Jawn\u0027s AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:39:01.067Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6"
},
{
"name": "https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b"
},
{
"name": "https://github.com/typelevel/jawn/releases/tag/v1.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/releases/tag/v1.7.0"
}
],
"source": {
"advisory": "GHSA-w4cm-gvhj-cgw6",
"discovery": "UNKNOWN"
},
"title": "Jawn: Quadratic parsing effort in AsyncParser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61814",
"datePublished": "2026-09-23T18:39:01.067Z",
"dateReserved": "2026-07-10T20:17:57.991Z",
"dateUpdated": "2026-09-23T19:41:40.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59990 (GCVE-0-2026-59990)
Vulnerability from nvd – Published: 2026-09-23 18:41 – Updated: 2026-09-23 19:27
VLAI
EPSS
VEX
Title
Jawn: Uncontrolled nesting depth in JSON parser
Summary
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:27 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/typelevel/jawn/security/adviso… | x_refsource_CONFIRM |
| https://github.com/typelevel/jawn/commit/191cb3a4… | x_refsource_MISC |
| https://github.com/typelevel/jawn/commit/62196666… | x_refsource_MISC |
| https://github.com/typelevel/jawn/commit/93ac93e9… | x_refsource_MISC |
| https://github.com/typelevel/jawn/commit/f6ace7e0… | x_refsource_MISC |
| https://github.com/typelevel/jawn/releases/tag/v1.7.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59990",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:27:50.740766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:27:58.498Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jawn",
"vendor": "typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:41:12.073Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3"
},
{
"name": "https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04"
},
{
"name": "https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed"
},
{
"name": "https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b"
},
{
"name": "https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214"
},
{
"name": "https://github.com/typelevel/jawn/releases/tag/v1.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/releases/tag/v1.7.0"
}
],
"source": {
"advisory": "GHSA-cc4v-rvgp-2pf3",
"discovery": "UNKNOWN"
},
"title": "Jawn: Uncontrolled nesting depth in JSON parser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59990",
"datePublished": "2026-09-23T18:41:12.073Z",
"dateReserved": "2026-07-07T19:41:00.005Z",
"dateUpdated": "2026-09-23T19:27:58.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-21653 (GCVE-0-2022-21653)
Vulnerability from nvd – Published: 2022-01-05 21:00 – Updated: 2025-04-22 18:34
VLAI
EPSS
VEX
Title
Hash collision in typelevel jawn
Summary
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:52 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/typelevel/jawn/security/adviso… | x_refsource_CONFIRM |
| https://github.com/typelevel/jawn/pull/390 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:46:39.225Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/typelevel/jawn/pull/390"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-21653",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:52:18.494433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T18:34:05.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jawn",
"vendor": "typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don\u0027t override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-05T21:00:12.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/pull/390"
}
],
"source": {
"advisory": "GHSA-vc89-hccf-rq55",
"discovery": "UNKNOWN"
},
"title": "Hash collision in typelevel jawn",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-21653",
"STATE": "PUBLIC",
"TITLE": "Hash collision in typelevel jawn"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "jawn",
"version": {
"version_data": [
{
"version_value": "\u003c 1.3.2"
}
]
}
}
]
},
"vendor_name": "typelevel"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don\u0027t override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-400: Uncontrolled Resource Consumption"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55",
"refsource": "CONFIRM",
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55"
},
{
"name": "https://github.com/typelevel/jawn/pull/390",
"refsource": "MISC",
"url": "https://github.com/typelevel/jawn/pull/390"
}
]
},
"source": {
"advisory": "GHSA-vc89-hccf-rq55",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-21653",
"datePublished": "2022-01-05T21:00:12.000Z",
"dateReserved": "2021-11-16T00:00:00.000Z",
"dateUpdated": "2025-04-22T18:34:05.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-59990 (GCVE-0-2026-59990)
Vulnerability from cvelistv5 – Published: 2026-09-23 18:41 – Updated: 2026-09-23 19:27
VLAI
EPSS
VEX
Title
Jawn: Uncontrolled nesting depth in JSON parser
Summary
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:27 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/typelevel/jawn/security/adviso… | x_refsource_CONFIRM |
| https://github.com/typelevel/jawn/commit/191cb3a4… | x_refsource_MISC |
| https://github.com/typelevel/jawn/commit/62196666… | x_refsource_MISC |
| https://github.com/typelevel/jawn/commit/93ac93e9… | x_refsource_MISC |
| https://github.com/typelevel/jawn/commit/f6ace7e0… | x_refsource_MISC |
| https://github.com/typelevel/jawn/releases/tag/v1.7.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59990",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:27:50.740766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:27:58.498Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jawn",
"vendor": "typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:41:12.073Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3"
},
{
"name": "https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04"
},
{
"name": "https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed"
},
{
"name": "https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b"
},
{
"name": "https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214"
},
{
"name": "https://github.com/typelevel/jawn/releases/tag/v1.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/releases/tag/v1.7.0"
}
],
"source": {
"advisory": "GHSA-cc4v-rvgp-2pf3",
"discovery": "UNKNOWN"
},
"title": "Jawn: Uncontrolled nesting depth in JSON parser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59990",
"datePublished": "2026-09-23T18:41:12.073Z",
"dateReserved": "2026-07-07T19:41:00.005Z",
"dateUpdated": "2026-09-23T19:27:58.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61814 (GCVE-0-2026-61814)
Vulnerability from cvelistv5 – Published: 2026-09-23 18:39 – Updated: 2026-09-23 19:41
VLAI
EPSS
VEX
Title
Jawn: Quadratic parsing effort in AsyncParser
Summary
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:25 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/typelevel/jawn/security/adviso… | x_refsource_CONFIRM |
| https://github.com/typelevel/jawn/commit/cddcd5e3… | x_refsource_MISC |
| https://github.com/typelevel/jawn/releases/tag/v1.7.0 | x_refsource_MISC |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| typelevel | jawn |
Affected:
< 1.7.0
|
|
| org.typelevel | jawn-parser_2.12 |
Affected:
< 1.7.0
|
|
| org.typelevel | jawn-parser_2.13 |
Affected:
< 1.7.0
|
|
| org.typelevel | jawn-parser_3 |
Affected:
< 1.7.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:25:56.569425Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:41:40.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jawn",
"vendor": "typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
},
{
"product": "jawn-parser_2.12",
"vendor": "org.typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
},
{
"product": "jawn-parser_2.13",
"vendor": "org.typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
},
{
"product": "jawn-parser_3",
"vendor": "org.typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jawn is an open source JSON parser. Prior to 1.7.0, Jawn\u0027s AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:39:01.067Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6"
},
{
"name": "https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b"
},
{
"name": "https://github.com/typelevel/jawn/releases/tag/v1.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/releases/tag/v1.7.0"
}
],
"source": {
"advisory": "GHSA-w4cm-gvhj-cgw6",
"discovery": "UNKNOWN"
},
"title": "Jawn: Quadratic parsing effort in AsyncParser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61814",
"datePublished": "2026-09-23T18:39:01.067Z",
"dateReserved": "2026-07-10T20:17:57.991Z",
"dateUpdated": "2026-09-23T19:41:40.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-21653 (GCVE-0-2022-21653)
Vulnerability from cvelistv5 – Published: 2022-01-05 21:00 – Updated: 2025-04-22 18:34
VLAI
EPSS
VEX
Title
Hash collision in typelevel jawn
Summary
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:52 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/typelevel/jawn/security/adviso… | x_refsource_CONFIRM |
| https://github.com/typelevel/jawn/pull/390 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:46:39.225Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/typelevel/jawn/pull/390"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-21653",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:52:18.494433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T18:34:05.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jawn",
"vendor": "typelevel",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don\u0027t override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-05T21:00:12.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/typelevel/jawn/pull/390"
}
],
"source": {
"advisory": "GHSA-vc89-hccf-rq55",
"discovery": "UNKNOWN"
},
"title": "Hash collision in typelevel jawn",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-21653",
"STATE": "PUBLIC",
"TITLE": "Hash collision in typelevel jawn"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "jawn",
"version": {
"version_data": [
{
"version_value": "\u003c 1.3.2"
}
]
}
}
]
},
"vendor_name": "typelevel"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don\u0027t override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-400: Uncontrolled Resource Consumption"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55",
"refsource": "CONFIRM",
"url": "https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55"
},
{
"name": "https://github.com/typelevel/jawn/pull/390",
"refsource": "MISC",
"url": "https://github.com/typelevel/jawn/pull/390"
}
]
},
"source": {
"advisory": "GHSA-vc89-hccf-rq55",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-21653",
"datePublished": "2022-01-05T21:00:12.000Z",
"dateReserved": "2021-11-16T00:00:00.000Z",
"dateUpdated": "2025-04-22T18:34:05.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}