{"id":"CVE-2018-18855","aliases":[],"url":"https://o3.security/vulnerability/CVE-2018-18855","summary":"Uncontrolled Resource Consumption in Spray JSON","details":"Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently \"open\" parsing state is kept on the stack.","published":"2022-06-28T23:23:20Z","modified":"2025-09-30T19:18:45.945287Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"io.spray:spray-json_2.10","fixedVersion":"1.3.5"},{"ecosystem":"Maven","name":"io.spray:spray-json_2.11","fixedVersion":"1.3.5"},{"ecosystem":"Maven","name":"io.spray:spray-json_2.11.0-RC4","fixedVersion":null},{"ecosystem":"Maven","name":"io.spray:spray-json_2.12","fixedVersion":"1.3.5"},{"ecosystem":"Maven","name":"io.spray:spray-json_2.12.0-M3","fixedVersion":null},{"ecosystem":"Maven","name":"io.spray:spray-json_2.12.0-M5","fixedVersion":null},{"ecosystem":"Maven","name":"io.spray:spray-json_2.12.0-RC1","fixedVersion":null},{"ecosystem":"Maven","name":"io.spray:spray-json_2.12.0-RC2","fixedVersion":null},{"ecosystem":"Maven","name":"io.spray:spray-json_2.13.0-M2","fixedVersion":null},{"ecosystem":"Maven","name":"io.spray:spray-json_2.13.0-M4","fixedVersion":null},{"ecosystem":"Maven","name":"io.spray:spray-json_2.13.0-M5","fixedVersion":"1.3.5"},{"ecosystem":"Maven","name":"io.spray:spray-json_2.9.3","fixedVersion":null}],"fix":{"url":"https://github.com/spray/spray-json/pull/284","label":"spray/spray-json#284"},"references":[{"type":"WEB","url":"https://github.com/spray/spray-json/pull/284"},{"type":"PACKAGE","url":"https://github.com/spray/spray-json"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JAVA-IOSPRAY-72601"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-09-30T19:18:45.945287Z"}}