GHSA-w4cm-gvhj-cgw6: High severity maven/org.typelevel:jawn-parser_3 vulnerability
AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.
Impact
Denial of service via CPU exhaustion when parsing untrusted JSON.
Preconditions: - Application uses AsyncParser - Attacker can send large tokens with control over chunk sizes.
Patches
Fixed in jawn-parser-1.7.0.
Workarounds
If you can't upgrade immediately: - Use the synchronous Parser. - Buffer incoming bytes into larger chunks before calling absorb
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.typelevel:jawn-parser_3to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
maven/org.typelevel:jawn-parser_2.13to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
maven/org.typelevel:jawn-parser_2.12to a version that resolves this vulnerability.Fixed in 1.7.0 - Upgrade
Upgrade
jawn-parserto a version that resolves this vulnerability.Fixed in 1.7.0 - Compensating control
Buffer incoming bytes into larger chunks before calling absorb to reduce rescanning of incomplete JSON tokens.
- Compensating control
Use the synchronous Parser instead of AsyncParser when parsing untrusted JSON.
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service condition?
Applications using AsyncParser to process untrusted JSON are exposed when an attacker can supply a large JSON token and control how it is split into incoming chunks. The issue can exhaust CPU resources during parsing.
What does an attacker need to do to trigger the problem?
The attacker must send a single JSON token across many small chunks. Each absorb call can rescan the incomplete token from the beginning, producing quadratic work relative to input length.
Are synchronous parser users affected?
The documented workaround is to use the synchronous Parser, indicating the issue is specific to AsyncParser processing. Applications that do not use AsyncParser are not identified as affected by the provided advisory.
What can be done before upgrading?
Use the synchronous Parser, or buffer incoming bytes into larger chunks before passing them to absorb. Both measures reduce exposure to the repeated rescanning behavior.
What version contains the fix?
The issue is fixed in jawn-parser 1.7.0.