cve-2026-61814

HIGH CVSS 7.5 cvelistv5
Description

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

Timeline
Published
2026-09-23 18:39 UTC
Last Modified
2026-09-23
CVSS Details
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Affected Products
  • typelevel jawn
  • org.typelevel jawn-parser_2.12
  • org.typelevel jawn-parser_2.13
  • org.typelevel jawn-parser_3
Weaknesses (CWE)
CWE-400 CWE-407
SSVC (CISA Stakeholder-Specific Vulnerability Categorization) CISA Coordinator v2.0.3
Exploitation
none
Automatable
yes
Technical Impact
partial
Decision timestamp
2026-09-23T19:25:56.569425Z

What is SSVC? — CISA's vulnerability-prioritisation framework using a decision tree rather than a single score.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:25:56.569425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:41:40.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jawn",
          "vendor": "typelevel",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.7.0"
            }
          ]
        },
        {
          "product": "jawn-parser_2.12",
          "vendor": "org.typelevel",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.7.0"
            }
          ]
        },
        {
          "product": "jawn-parser_2.13",
          "vendor": "org.typelevel",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.7.0"
            }
          ]
        },
        {
          "product": "jawn-parser_3",
          "vendor": "org.typelevel",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:39:01.067Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6"
        },
        {
          "name": "https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b"
        },
        {
          "name": "https://github.com/typelevel/jawn/releases/tag/v1.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/typelevel/jawn/releases/tag/v1.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-w4cm-gvhj-cgw6",
        "discovery": "UNKNOWN"
      },
      "title": "Jawn: Quadratic parsing effort in AsyncParser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61814",
    "datePublished": "2026-09-23T18:39:01.067Z",
    "dateReserved": "2026-07-10T20:17:57.991Z",
    "dateUpdated": "2026-09-23T19:41:40.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
View JSON API Download JSON