요약
- CVE-2026-61814은(는) org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13, org.typelevel:jawn-parser_3에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.75%, 전체 취약점의 55.0%보다 높음.
- 조치: 1.7.0 이상으로 업데이트하세요.
Description
AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.
Impact
Denial of service via CPU exhaustion when parsing untrusted JSON.
Preconditions:
- Application uses
AsyncParser
- Attacker can send large tokens with control over chunk sizes.
Patches
Fixed in jawn-parser-1.7.0.
Workarounds
If you can't upgrade immediately:
- Use the synchronous
Parser.
- Buffer incoming bytes into larger chunks before calling
absorb
NVD description
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
org.typelevel:jawn-parser_2.12의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free