GHSA-cc4v-rvgp-2pf3: Jawn: Uncontrolled nesting depth in JSON parser
HIGHHigh-risk vulnerability — CVSS 7.5
The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input. ### Impact A remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger `java.lang.OutOfMemoryError`. This is treated by Scala as a fatal error and not typically handled by `scala.util.Try` or `cats.effect.IO`. ### Patches Version `1.6.1` introduces a configurable nesting-depth limit (`Parser#maxDepth`, default `4096`). Inputs deeper than the limit fail with a recoverable `ParseException` instead of exhausting heap. …
CVE · detail
- CVE-2026-59990nvd ↗EPSS 0.62%
● loading threat intel…
Early access
Get the next one first.
Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.
bot-protected