Most recent entries from all

fkie_cve-2026-61814

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

GHSA-w4cm-gvhj-cgw6 — Jawn: Quadratic parsing effort in AsyncParser

Affected: Maven: org.typelevel:jawn-parser_2.12, Maven: org.typelevel:jawn-parser_2.13, Maven: org.typelevel:jawn-parser_3

`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each `absorb` call rescans the incomplete token from the start.

### Impact

Denial of service via CPU exhaustion when parsing untrusted JSON.

Preconditions: - Application uses `AsyncParser` - Attacker can send large tokens with control over chunk sizes.

### Patches

Fixed in jawn-parser-1.7.0.

### Workarounds

If you can't upgrade immediately: - Use the synchronous `Parser`. - Buffer incoming bytes into larger chunks before calling `absorb`

UBUNTU-CVE-2026-61814

Affected: Ubuntu:20.04:LTS: jawn, Ubuntu:22.04:LTS: jawn, Ubuntu:24.04:LTS: jawn, Ubuntu:26.04:LTS: jawn