CVE-2026-59990: Jawn: Uncontrolled nesting depth in JSON parser
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.
Other sources
The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input.
Impact
A remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger java.lang.OutOfMemoryError. This is treated by Scala as a fatal error and not typically handled by scala.util.Try or cats.effect.IO.
Patches
Version 1.6.1 introduces a configurable nesting-depth limit (Parser#maxDepth, default 4096). Inputs deeper than the limit fail with a recoverable ParseException instead of exhausting heap.
Users who require deeper nesting may override maxDepth on a Parser subclass.
Workarounds
- Enforce an input size limit small enough that the resulting context stack cannot exhaust heap, (e.g. http4s EntityLimiter). - Pre-scan untrusted input and reject documents whose maximum delimiter nesting exceeds a threshold before handing them to jawn.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.typelevel:jawn-parser_3to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
maven/org.typelevel:jawn-parser_2.13to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
maven/org.typelevel:jawn-parser_2.12to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
Jawnto a version that resolves this vulnerability.Fixed in 1.7.0 - Configuration
Configure the parser nesting-depth limit; version 1.6.1 introduces Parser#maxDepth with a default of 4096.
Jawn Parser Parser#maxDepth = 4096 - Compensating control
Enforce an input-size limit small enough that the resulting JSON context stack cannot exhaust the JVM heap, such as using http4s EntityLimiter.
- Compensating control
Pre-scan untrusted JSON input and reject documents whose maximum delimiter nesting exceeds a defined threshold before passing them to Jawn.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using Jawn versions before 1.7.0 are exposed if they accept untrusted JSON from a remote source. An attacker does not need authentication or user interaction if they can submit that JSON to the application.
What is required to trigger the issue?
An attacker can submit JSON containing arbitrarily deep array or object nesting. Repeated nesting grows parser contexts until JVM heap exhaustion causes a java.lang.OutOfMemoryError.
Will normal Scala error handling keep the service available?
Not ordinarily. The reported java.lang.OutOfMemoryError is a fatal Scala error and is not normally handled by scala.util.Try or cats.effect.IO, so the application can be denied service.
What version resolves the issue?
Upgrade Jawn to version 1.7.0, which adds the fix for unbounded JSON nesting depth.