typelevel/jawn · Security
Jawn: Quadratic parsing effort in AsyncParser
- GHSA ID
- GHSA-w4cm-gvhj-cgw6
- CVE ID
- CVE-2026-61814
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.
Impact
Denial of service via CPU exhaustion when parsing untrusted JSON.
Preconditions:
- Application uses
AsyncParser - Attacker can send large tokens with control over chunk sizes.
Patches
Fixed in jawn-parser-1.7.0.
Workarounds
If you can't upgrade immediately:
- Use the synchronous
Parser. - Buffer incoming bytes into larger chunks before calling
absorb
CWEs
- CWE-400 · Uncontrolled Resource Consumption
- CWE-407 · Inefficient Algorithmic Complexity