CVE-2026-61814
HighCVSS 7.5Summary
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
Risk Assessment
Applications using AsyncParser can become unavailable due to CPU exhaustion by a remote attacker sending appropriately chunked JSON input.
Recommendation
Update the Jawn library to version 1.7.0 or later. Consider limiting the size and number of chunks fed to the parser.
Other vulnerabilities in Jawn
See all- CVE-2026-59990High
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.
- CVE-2026-66648Critical
Unauthenticated Privilege Escalation in Jawn versions up to 1.4.2. An attacker can gain elevated privileges without authentication.
Original NVD description (English source)
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.