Skip to content
← archivevulnerability · 23 Sep 2026 · 21:23 UTC

GHSA-w4cm-gvhj-cgw6: Jawn: Quadratic parsing effort in AsyncParser

VULNCVE-2026-61814source · GTH
HIGHHigh-risk vulnerability — CVSS 7.5

last 60 dispatches · spectrum

`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each `absorb` call rescans the incomplete token from the start. ### Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application uses `AsyncParser` - Attacker can send large tokens with control over chunk sizes. ### Patches Fixed in jawn-parser-1.7.0. ### Workarounds If you can't upgrade immediately: - Use the synchronous `Parser`. …

grounded ✓primary source ↗
Early access

Get the next one first.

Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.

bot-protected