jawn vulnerabilities

3 known vulnerabilities in jawn from Typelevel. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  jawn: Uncontrolled Resource Consumption

  CVE-2026-61814Sep 23, 2026Typelevel

  Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who control

• 7.5 High severity

  jawn: Allocation of Resources Without Limits or Throttling

  CVE-2026-59990Sep 23, 2026Typelevel

  Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted

• 7.5 High severity

  jawn: Inadequate Encryption Strength

  CVE-2022-21653Jan 5, 2022Typelevel

  Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applicati