GHSA-w4cm-gvhj-cgw6: Jawn: Quadratic parsing effort in AsyncParser
HIGHHigh-risk vulnerability — CVSS 7.5
`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each `absorb` call rescans the incomplete token from the start. ### Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application uses `AsyncParser` - Attacker can send large tokens with control over chunk sizes. ### Patches Fixed in jawn-parser-1.7.0. ### Workarounds If you can't upgrade immediately: - Use the synchronous `Parser`. …
CVE · detail
Early access
Get the next one first.
Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.
bot-protected