Typelevel vulnerabilities
We track 5 vulnerabilities in Typelevel products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
Latest Typelevel vulnerabilities
- 7.5 High severity
jawn: Uncontrolled Resource Consumption
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who control
- 7.5 High severity
jawn: Allocation of Resources Without Limits or Throttling
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted
- 7.5 High severity
grackle: Uncontrolled Resource Consumption
Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn't check
- 9.8 Critical severity
fs2: Improper Certificate Validation
fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerabil
- 7.5 High severity
jawn: Inadequate Encryption Strength
Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applicati