Jawn
Monthly
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the thrown java.lang.OutOfMemoryError is a fatal Scala/JVM error that neither scala.util.Try nor cats.effect.IO routinely intercepts, turning untrusted JSON into a denial-of-service condition. The assessed impact is availability-only (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so remote unauthenticated attackers need only reach an endpoint that feeds attacker-controlled input into a pre-1.7.0 Jawn parse call, directly or transitively through circe; services that only parse trusted or internal JSON are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but this is a genuine, middle-tier priority for any internet-facing JSON API on an affected version; fixed in 1.7.0, which introduces a configurable depth cap.
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the thrown java.lang.OutOfMemoryError is a fatal Scala/JVM error that neither scala.util.Try nor cats.effect.IO routinely intercepts, turning untrusted JSON into a denial-of-service condition. The assessed impact is availability-only (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so remote unauthenticated attackers need only reach an endpoint that feeds attacker-controlled input into a pre-1.7.0 Jawn parse call, directly or transitively through circe; services that only parse trusted or internal JSON are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but this is a genuine, middle-tier priority for any internet-facing JSON API on an affected version; fixed in 1.7.0, which introduces a configurable depth cap.
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.