Skip to content

Product

typelevel jawn vulnerabilities

3 published CVES affecting typelevel jawn, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
3
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest typelevel jawn CVEs

Newest publication first

  1. CVE-2026-59990 Jawn: Uncontrolled nesting depth in JSON parser

    Published
    HighCVSS 7.5 EPSS 0.62%

    Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java...

  2. CVE-2026-61814 Jawn: Quadratic parsing effort in AsyncParser

    Published
    HighCVSS 7.5 EPSS 0.75%

    Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON inp...

  3. CVE-2022-21653 Hash collision in typelevel jawn

    Published
    HighCVSS 7.5 EPSS 0.82%

    Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.