AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.

Impact

Denial of service via CPU exhaustion when parsing untrusted JSON.

Preconditions: - Application uses AsyncParser - Attacker can send large tokens with control over chunk sizes.

Patches

Fixed in jawn-parser-1.7.0.

Workarounds

If you can't upgrade immediately: - Use the synchronous Parser. - Buffer incoming bytes into larger chunks before calling absorb

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.