CVE-2026-61814: Jawn: Quadratic parsing effort in AsyncParser
AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.
Impact
Denial of service via CPU exhaustion when parsing untrusted JSON.
Preconditions: - Application uses AsyncParser - Attacker can send large tokens with control over chunk sizes.
Patches
Fixed in jawn-parser-1.7.0.
Workarounds
If you can't upgrade immediately: - Use the synchronous Parser. - Buffer incoming bytes into larger chunks before calling absorb
Other sources
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.typelevel:jawn-parser_3to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
maven/org.typelevel:jawn-parser_2.13to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
maven/org.typelevel:jawn-parser_2.12to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
jawn-parserto a version that resolves this vulnerability.Fixed in 1.7.0 - Compensating control
Buffer incoming bytes into larger chunks before calling absorb to reduce rescanning of incomplete tokens.
- Compensating control
Use the synchronous Parser instead of AsyncParser when processing untrusted JSON.
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service issue?
Applications using Jawn's AsyncParser on untrusted JSON are exposed when an attacker can control both the JSON input and how it is split into chunks. The impact is CPU exhaustion, resulting in denial of service.
Does exploitation require authentication or user interaction?
No. The vector is network-accessible, requires low attack complexity, and requires neither privileges nor user interaction.
What input pattern triggers the excessive CPU use?
A single JSON token must be delivered across many small chunks. Before the token is complete, each absorb call can rescan the incomplete token from its start, producing quadratic parsing work.
What version contains the fix?
The issue is fixed in Jawn version 1.7.0. Upgrading to 1.7.0 removes the vulnerable AsyncParser behavior.