Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.

AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.

Impact

Denial of service via CPU exhaustion when parsing untrusted JSON.

Preconditions: - Application uses AsyncParser - Attacker can send large tokens with control over chunk sizes.

Patches

Fixed in jawn-parser-1.7.0.

Workarounds

If you can't upgrade immediately: - Use the synchronous Parser. - Buffer incoming bytes into larger chunks before calling absorb