CVE Feed

    Dashboard / CVE / CVE-2026-61814

    CVE-2026-61814

    Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

    Published:Sep 23, 2026
    Last Modified:Sep 24, 2026
    EPS:Sep 23, 2026
    EPSS Score:
    CVSS Score:7.5

    Affected Products

    Vendor
    Org.typelevel
    Product
    Jawn-parser 2.12
    Vendor
    Org.typelevel
    Product
    Jawn-parser 2.13
    Vendor
    Org.typelevel
    Product
    Jawn-parser 3
    Vendor
    Typelevel
    Product
    Jawn

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High