Every CVE Search/ Get API key

CVE-2026-61814

Jawn: Quadratic parsing effort in AsyncParser

7.5 HighFix available

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.75%Up 0.2 points since Sep 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Jawn: Quadratic parsing effort in AsyncParser

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

Record
CVE-2026-61814
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-407
Updated
2026-11-02
EUVDEUVD-2026-85551 7.5

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

Record
EUVD-2026-85551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-w4cm-gvhj-cgw6 7.5

Jawn: Quadratic parsing effort in AsyncParser

AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.

Impact

Denial of service via CPU exhaustion when parsing untrusted JSON.

Preconditions:

  • Application uses AsyncParser
  • Attacker can send large tokens with control over chunk sizes.

Patches

Fixed in jawn-parser-1.7.0.

Workarounds

If you can't upgrade immediately:

  • Use the synchronous Parser.
  • Buffer incoming bytes into larger chunks before calling absorb
Record
GHSA-w4cm-gvhj-cgw6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-407
Updated
2026-11-02
NVD 7.5

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

Record
CVE-2026-61814
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-407
Updated
2026-11-02
OSV 7.5

Jawn: Quadratic parsing effort in AsyncParser

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

Record
CVE-2026-61814
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-407
Updated
2026-11-02
OSVDEBIAN-CVE-2026-61814 7.5

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

Record
DEBIAN-CVE-2026-61814
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-w4cm-gvhj-cgw6 7.5

Jawn: Quadratic parsing effort in AsyncParser

AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.

Impact

Denial of service via CPU exhaustion when parsing untrusted JSON.

Preconditions:

  • Application uses AsyncParser
  • Attacker can send large tokens with control over chunk sizes.

Patches

Fixed in jawn-parser-1.7.0.

Workarounds

If you can't upgrade immediately:

  • Use the synchronous Parser.
  • Buffer incoming bytes into larger chunks before calling absorb
Record
GHSA-w4cm-gvhj-cgw6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-407
Updated
2026-11-02
OSVUBUNTU-CVE-2026-61814 7.5

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

Record
UBUNTU-CVE-2026-61814
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2026:4407-1 No score

Security update for jawn

This update for jawn fixes the following issue:

  • CVE-2026-61814: quadratic rescan complexity in AsyncParser can cause excessive CPU resource exhaustion (bsc#1282548).
Record
SUSE-SU-2026:4407-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.typelevel:jawn-parser_2.12
Maven
 through 1.6.0
1.7.0
org.typelevel:jawn-parser_2.13
Maven
 through 1.6.0
1.7.0
org.typelevel:jawn-parser_3
Maven
 through 1.6.0
1.7.0
jawn
Debian:12
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
jawn
Debian:13
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
jawn
Debian:14
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
org.typelevel:jawn-parser_2.12
Maven
 before 1.7.0, plus listed versions
0.14.00.14.10.14.20.14.31.0.0
Show 18 moreShow less
1.0.0-RC11.0.0-RC21.0.0-RC31.0.0-RC41.0.11.0.21.0.31.1.01.1.11.1.21.2.01.3.01.3.11.3.21.4.01.5.01.5.11.6.0
1.7.0
org.typelevel:jawn-parser_2.13
Maven
 before 1.7.0, plus listed versions
0.14.20.14.31.0.01.0.0-RC11.0.0-RC2
Show 16 moreShow less
1.0.0-RC31.0.0-RC41.0.11.0.21.0.31.1.01.1.11.1.21.2.01.3.01.3.11.3.21.4.01.5.01.5.11.6.0
1.7.0
org.typelevel:jawn-parser_3
Maven
 before 1.7.0, plus listed versions
1.1.21.2.01.3.01.3.11.3.2
Show 4 moreShow less
1.4.01.5.01.5.11.6.0
1.7.0
jawn
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 0.14.1-150200.3.6.1
0.14.1-150200.3.6.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
jawn
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
jawn
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
jawn
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
jawn
Ubuntu:26.10
 All versions, plus listed versions
0.11.1+really0.6.0-1build1
 None known
jawn
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.11.1+really0.6.0-10.11.1+really0.6.0-1build1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-61814 is a high vulnerability (CVSS 7.5) in Typelevel Jawn, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in org.typelevel:jawn-parser_2.12 1.7.0.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open