GHSA-cc4v-rvgp-2pf3: High severity maven/org.typelevel:jawn-parser_3 vulnerability
The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input.
Impact
A remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger java.lang.OutOfMemoryError. This is treated by Scala as a fatal error and not typically handled by scala.util.Try or cats.effect.IO.
Patches
Version 1.6.1 introduces a configurable nesting-depth limit (Parser#maxDepth, default 4096). Inputs deeper than the limit fail with a recoverable ParseException instead of exhausting heap.
Users who require deeper nesting may override maxDepth on a Parser subclass.
Workarounds
- Enforce an input size limit small enough that the resulting context stack cannot exhaust heap, (e.g. http4s EntityLimiter). - Pre-scan untrusted input and reject documents whose maximum delimiter nesting exceeds a threshold before handing them to jawn.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.typelevel:jawn-parser_3to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
maven/org.typelevel:jawn-parser_2.13to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
maven/org.typelevel:jawn-parser_2.12to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
Jawn parserto a version that resolves this vulnerability.Fixed in 1.6.1 - Compensating control
Enforce an input size limit small enough that the resulting context stack cannot exhaust the JVM heap.
- Compensating control
Pre-scan untrusted JSON input and reject documents whose maximum delimiter nesting exceeds a defined threshold before passing them to Jawn.
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Any application using a vulnerable Jawn parser that accepts JSON from remote or otherwise untrusted sources through a Jawn-backed parse method is exposed. An attacker does not need credentials or user interaction if they can submit that JSON.
Are default settings protected after upgrading?
Yes. Version 1.6.1 adds Parser#maxDepth with a default nesting-depth limit of 4096. Documents exceeding that depth fail with a recoverable ParseException rather than exhausting JVM heap.
What can be done before upgrading?
Apply an input size limit low enough to prevent the parser's context stack from exhausting heap, such as http4s EntityLimiter. Alternatively, pre-scan untrusted JSON and reject documents whose delimiter nesting exceeds a chosen threshold before passing them to Jawn.
Why might existing error handling not prevent service failure?
The vulnerable behavior can cause java.lang.OutOfMemoryError. Scala treats this as fatal, so it is not typically handled by scala.util.Try or cats.effect.IO.