Jawn EUVD-2026-85551

Exploitation requires that the target application use Jawn's AsyncParser in incremental/streaming mode and feed it attacker-influenced JSON, AND that the attacker control the chunking/framing of that input (e.g., by controlling TCP segmentation or how bytes are delivered) so that a single JSON token is split across many small chunks. The limiting factors are: the app must use AsyncParser rather than a synchronous parse of a complete buffer; the attacker must be able to influence chunk boundaries, not just content; and impact is availability-only (CPU exhaustion), with no data disclosure or modification. Applications that buffer the full request before parsing, or that use synchronous Jawn parsing, are not affected.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) yields 7.5 (HIGH), driven entirely by an availability impact - this is a pure CPU-exhaustion denial-of-service with no confidentiality or integrity effect. No EPSS score, KEV listing, or SSVC decision data was supplied in the input, and there is no weaponized public exploit flag; therefore exploitation status is 'no public exploit identified at time of analysis,' though the vendor fix commit (cddcd5e) ships demonstrative property tests that feed pathological inputs (100k-char strings, 200k-digit numbers) byte-by-byte, which effectively documents how to trigger the flaw. One signal conflicts with the raw score: the description requires the attacker to control not only the JSON content but also its chunk boundaries/framing, and exploitation only manifests when the application uses AsyncParser in streaming mode - these are real preconditions that AC:L (attack complexity low) arguably understates; I lean toward AC:H (~5.9), so the effective real-world risk is somewhat below the 7.5 headline. This is a genuine but bounded DoS issue rather than a critical priority: impact is availability-only, it is patch-driven (no active-exploitation evidence), and the affected component sits in the niche Scala/JVM ecosystem, so prioritize patching for services that stream/chunk untrusted JSON through Jawn AsyncParser (directly or transitively via circe).

An application accepts untrusted JSON over a network connection and feeds it incrementally to Jawn's AsyncParser as bytes arrive. A remote unauthenticated attacker sends a single large JSON token (e.g., a very long string or number) split into many tiny chunks, forcing each absorb() call to rescan the incomplete token from the start and producing O(n²) CPU work that exhausts a core and stalls the service. No weaponized public exploit is provided, but the 1.7.0 fix commit includes property tests demonstrating the exact triggering inputs.