Scala
Monthly
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the thrown java.lang.OutOfMemoryError is a fatal Scala/JVM error that neither scala.util.Try nor cats.effect.IO routinely intercepts, turning untrusted JSON into a denial-of-service condition. The assessed impact is availability-only (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so remote unauthenticated attackers need only reach an endpoint that feeds attacker-controlled input into a pre-1.7.0 Jawn parse call, directly or transitively through circe; services that only parse trusted or internal JSON are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but this is a genuine, middle-tier priority for any internet-facing JSON API on an affected version; fixed in 1.7.0, which introduces a configurable depth cap.
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.
Cross-site request forgery in Yahoo CMAK (Cluster Manager for Apache Kafka) through 3.0.0.6 allows an attacker to make a logged-in operator's browser silently submit forged POST requests that delete topics or change cluster configuration, riding the operator's existing HTTP Basic credentials or play-basic-authentication cookie. The root cause is a confirmed missing CSRF filter combined with an authentication cookie that has no SameSite protection, so no per-request token stands between the forged request and destructive state-changing endpoints. The attacker needs no account of their own, but exploitation does require a valid authenticated operator session plus user interaction (luring that operator to attacker-controlled content), and no public exploit code has been identified at time of analysis.
Request smuggling in the http4s Ember HTTP/1.1 parser lets an unauthenticated, remote attacker bypass front-end access controls, splice a victim request onto an attacker-controlled prefix, or poison a caching layer, but only where ember-server runs as an origin behind a keep-alive intermediary that forwards both Transfer-Encoding and Content-Length headers and frames the body by Content-Length while Ember frames by chunked (a CL.TE mismatch); a standalone Ember server with no fronting proxy is not exploitable, and the client path only desyncs when a malicious or compromised upstream sends both headers over a pooled ember-client connection. The flaw affects http4s-ember-core 0.23.34 and earlier in the 0.23.x line, plus 1.0.0-M1 through 1.0.0-M46, with a parser that fails to treat dual-framed messages as the framing error RFC 9112 §6.1 requires; the vendor-assessed CVSS 4.0 score is 9.2, with the topology dependency captured by the AT:P metric. Fixed in 0.23.35 and 1.0.0-M47 (vendor-released patch); no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.
Yahoo CMAK through 3.0.0.6 fails to enforce its scheduled leader election feature toggle on the PreferredReplicaElection HTML form routes, allowing an authenticated user (CVSS PR:L) with network access to the web UI to start or stop the recurring election scheduler and disrupt leadership across the Kafka clusters managed by that instance. This is a protection-mechanism failure (CWE-693) with no confidentiality impact (C:N) and limited integrity/availability impact (I:L/A:L); the assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), and no public exploit code has been identified at time of analysis. Environments are at risk only if they run CMAK 3.0.0.6 or earlier and actively manage live Kafka clusters.
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the thrown java.lang.OutOfMemoryError is a fatal Scala/JVM error that neither scala.util.Try nor cats.effect.IO routinely intercepts, turning untrusted JSON into a denial-of-service condition. The assessed impact is availability-only (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so remote unauthenticated attackers need only reach an endpoint that feeds attacker-controlled input into a pre-1.7.0 Jawn parse call, directly or transitively through circe; services that only parse trusted or internal JSON are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but this is a genuine, middle-tier priority for any internet-facing JSON API on an affected version; fixed in 1.7.0, which introduces a configurable depth cap.
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.
Cross-site request forgery in Yahoo CMAK (Cluster Manager for Apache Kafka) through 3.0.0.6 allows an attacker to make a logged-in operator's browser silently submit forged POST requests that delete topics or change cluster configuration, riding the operator's existing HTTP Basic credentials or play-basic-authentication cookie. The root cause is a confirmed missing CSRF filter combined with an authentication cookie that has no SameSite protection, so no per-request token stands between the forged request and destructive state-changing endpoints. The attacker needs no account of their own, but exploitation does require a valid authenticated operator session plus user interaction (luring that operator to attacker-controlled content), and no public exploit code has been identified at time of analysis.
Request smuggling in the http4s Ember HTTP/1.1 parser lets an unauthenticated, remote attacker bypass front-end access controls, splice a victim request onto an attacker-controlled prefix, or poison a caching layer, but only where ember-server runs as an origin behind a keep-alive intermediary that forwards both Transfer-Encoding and Content-Length headers and frames the body by Content-Length while Ember frames by chunked (a CL.TE mismatch); a standalone Ember server with no fronting proxy is not exploitable, and the client path only desyncs when a malicious or compromised upstream sends both headers over a pooled ember-client connection. The flaw affects http4s-ember-core 0.23.34 and earlier in the 0.23.x line, plus 1.0.0-M1 through 1.0.0-M46, with a parser that fails to treat dual-framed messages as the framing error RFC 9112 §6.1 requires; the vendor-assessed CVSS 4.0 score is 9.2, with the topology dependency captured by the AT:P metric. Fixed in 0.23.35 and 1.0.0-M47 (vendor-released patch); no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.
Yahoo CMAK through 3.0.0.6 fails to enforce its scheduled leader election feature toggle on the PreferredReplicaElection HTML form routes, allowing an authenticated user (CVSS PR:L) with network access to the web UI to start or stop the recurring election scheduler and disrupt leadership across the Kafka clusters managed by that instance. This is a protection-mechanism failure (CWE-693) with no confidentiality impact (C:N) and limited integrity/availability impact (I:L/A:L); the assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), and no public exploit code has been identified at time of analysis. Environments are at risk only if they run CMAK 3.0.0.6 or earlier and actively manage live Kafka clusters.
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.