Skip to content
← archivevulnerability · 23 Sep 2026 · 21:23 UTC

GHSA-cc4v-rvgp-2pf3: Jawn: Uncontrolled nesting depth in JSON parser

VULNCVE-2026-59990source · GTH
HIGHHigh-risk vulnerability — CVSS 7.5

last 60 dispatches · spectrum

The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. ### Impact A remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger `java.lang.OutOfMemoryError`. This is treated by Scala as a fatal error and not typically handled by `scala.util.Try` or `cats.effect.IO`. ### Patches Version `1.6.1` introduces a configurable nesting-depth limit (`Parser#maxDepth`, default `4096`). Inputs deeper than the limit fail with a recoverable `ParseException` instead of exhausting heap. …

CVE · detail
grounded ✓primary source ↗

● loading threat intel…

Early access

Get the next one first.

Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.

bot-protected