Typelevel
Monthly
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the thrown java.lang.OutOfMemoryError is a fatal Scala/JVM error that neither scala.util.Try nor cats.effect.IO routinely intercepts, turning untrusted JSON into a denial-of-service condition. The assessed impact is availability-only (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so remote unauthenticated attackers need only reach an endpoint that feeds attacker-controlled input into a pre-1.7.0 Jawn parse call, directly or transitively through circe; services that only parse trusted or internal JSON are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but this is a genuine, middle-tier priority for any internet-facing JSON API on an affected version; fixed in 1.7.0, which introduces a configurable depth cap.
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
fs2 is a compositional, streaming I/O library for Scala. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
http4s is an open source scala interface for HTTP. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Http4s is a minimal, idiomatic Scala interface for HTTP services. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Deeply nested JSON arrays and objects drive JVM heap exhaustion in Typelevel Jawn versions before 1.7.0, where the thrown java.lang.OutOfMemoryError is a fatal Scala/JVM error that neither scala.util.Try nor cats.effect.IO routinely intercepts, turning untrusted JSON into a denial-of-service condition. The assessed impact is availability-only (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so remote unauthenticated attackers need only reach an endpoint that feeds attacker-controlled input into a pre-1.7.0 Jawn parse call, directly or transitively through circe; services that only parse trusted or internal JSON are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but this is a genuine, middle-tier priority for any internet-facing JSON API on an affected version; fixed in 1.7.0, which introduces a configurable depth cap.
Denial of service in the Jawn JSON parser for Scala (all artifacts prior to 1.7.0) lets a remote, unauthenticated attacker exhaust CPU by feeding JSON through the streaming AsyncParser in many tiny chunks, forcing repeated rescans of a single incomplete token. Exploitation is bounded by two preconditions: the target must parse attacker-influenced input incrementally via AsyncParser rather than parsing a fully buffered document, and the attacker must be able to influence chunk boundaries so that one token is split across many small reads - hence the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only (HIGH) impact with no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fixed the issue in version 1.7.0.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
fs2 is a compositional, streaming I/O library for Scala. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
http4s is an open source scala interface for HTTP. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Http4s is a minimal, idiomatic Scala interface for HTTP services. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.