{"id":"CVE-2026-61814","aliases":["GHSA-w4cm-gvhj-cgw6"],"url":"https://o3.security/vulnerability/CVE-2026-61814","summary":"Jawn: Quadratic parsing effort in AsyncParser","details":"`AsyncParser` can be forced to perform O(n^2) work on the length of the input.  When a single JSON token arrives across many small chunks, each `absorb` call rescans the incomplete token from the start.\n\n### Impact\n\nDenial of service via CPU exhaustion when parsing untrusted JSON.\n\nPreconditions:\n- Application uses `AsyncParser`\n- Attacker can send large tokens with control over chunk sizes.\n\n### Patches\n\nFixed in jawn-parser-1.7.0.\n\n### Workarounds\n\nIf you can't upgrade immediately:\n- Use the synchronous `Parser`.\n- Buffer incoming bytes into larger chunks before calling `absorb`","published":"2026-09-23T18:39:01.067Z","modified":"2026-10-21T02:58:52.852638221Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.typelevel:jawn-parser_2.12","fixedVersion":"1.7.0"},{"ecosystem":"Maven","name":"org.typelevel:jawn-parser_2.13","fixedVersion":"1.7.0"},{"ecosystem":"Maven","name":"org.typelevel:jawn-parser_3","fixedVersion":"1.7.0"}],"fix":{"url":"https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b","label":"typelevel/jawn@cddcd5e"},"references":[{"type":"WEB","url":"https://github.com/typelevel/jawn/releases/tag/v1.7.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61814.json"},{"type":"ADVISORY","url":"https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61814"},{"type":"FIX","url":"https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b"},{"type":"PACKAGE","url":"https://github.com/typelevel/jawn"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:52.852638221Z"}}