Typelevel Jawn CVE-2026-59990

No special conditions beyond the target application actually parsing attacker-controlled JSON with Jawn's parse methods (versions prior to 1.7.0), either directly or transitively via circe - unauthenticated remote exploitation against default configurations, since versions before 1.7.0 shipped no depth limit at all. What limits exploitation: the attacker must reach an endpoint that feeds untrusted input to a Jawn parse call; services that only parse trusted/internal JSON are not exposed. On 1.7.0+, the new configurable jawn.parser.maxDepth (default 4096) caps nesting, so the condition is specifically running a pre-1.7.0 version.

This is a genuine but middle-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with the description: any network-reachable endpoint that parses untrusted JSON with Jawn can be crashed by unauthenticated attackers sending deeply nested arrays/objects, with no user interaction and low complexity. The impact is availability-only (C:N/I:N) - this cannot leak data or corrupt state, only crash the JVM via an OutOfMemoryError that, per the description, is a fatal Scala error not caught by scala.util.Try or cats.effect.IO, so normal error-handling wrappers do not contain it. Weighing all signals: no EPSS score, no CISA KEV listing, and no public exploit code are provided, so despite the 7.5 'High' rating there is no evidence of real-world or widespread exploitation; the danger is amplified by the fact that Jawn underpins circe (a very common Scala JSON library), so the flaw can be present transitively in services that never chose Jawn directly. Net: a real, easy-to-trigger DoS worth patching promptly on any internet-facing Scala/JVM service, but not an emergency in the absence of KEV/POC signals and given availability-only impact.

An attacker sends an HTTP request whose body is a JSON payload with tens of thousands of nested opening brackets (e.g. '[[[[...') to any endpoint of a Scala/JVM service that parses request bodies with Jawn (directly or via circe). Jawn grows a parser context per nesting level with no depth cap until the JVM heap is exhausted, throwing an uncatchable OutOfMemoryError that the application's Try/IO wrappers do not handle, crashing the process. No public exploit code is identified, but the payload is trivial to construct and requires no authentication.