In short
- CVE-2026-61814 is a HIGH (CVSS 7.5) vulnerability affecting org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13, org.typelevel:jawn-parser_3.
- Chance of exploitation in the next 30 days (EPSS): 0.75%, higher than 55.0% of all vulnerabilities.
- Fix: update to 1.7.0 or later.
Description
AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.
Impact
Denial of service via CPU exhaustion when parsing untrusted JSON.
Preconditions:
- Application uses
AsyncParser
- Attacker can send large tokens with control over chunk sizes.
Patches
Fixed in jawn-parser-1.7.0.
Workarounds
If you can't upgrade immediately:
- Use the synchronous
Parser.
- Buffer incoming bytes into larger chunks before calling
absorb
NVD description
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
More vulnerabilities in org.typelevel:jawn-parser_2.12
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free