| Package | Affected versions | Patched versions |
|---|---|---|
| io.spray:spray-json_2.10 | < 1.3.5 | 1.3.5 |
| io.spray:spray-json_2.11 | < 1.3.5 | 1.3.5 |
| io.spray:spray-json_2.11.0-RC4 | all versions | |
| io.spray:spray-json_2.12 | < 1.3.5 | 1.3.5 |
| io.spray:spray-json_2.12.0-M3 | all versions | |
| io.spray:spray-json_2.12.0-M5 | all versions | |
| io.spray:spray-json_2.12.0-RC1 | all versions | |
| io.spray:spray-json_2.12.0-RC2 | all versions | |
| io.spray:spray-json_2.13.0-M2 | all versions | |
| io.spray:spray-json_2.13.0-M4 | all versions | |
| io.spray:spray-json_2.13.0-M5 | < 1.3.5 | 1.3.5 |
| io.spray:spray-json_2.9.3 | all versions |
Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free