Jawn Parser 2 12
Monthly
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.