Every CVE Search/ Get API key

CVE-2022-21653

Hash collision in typelevel jawn

5.9 MediumFix available

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. jawn-parser-1.3.1 fixes this issue and users are advised to upgrade. For users unable to upgrade override objectContext() to use a collision-safe collection.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.82%Down 0.1 points since Feb 8, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.9

Hash collision in typelevel jawn

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. jawn-parser-1.3.1 fixes this issue and users are advised to upgrade. For users unable to upgrade override objectContext() to use a collision-safe collection.

Record
CVE-2022-21653
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2022-0702 5.9

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. jawn-parser-1.3.1 fixes this issue and users are advised to upgrade. For users unable to upgrade override objectContext() to use a collision-safe collection.

Record
EUVD-2022-0702
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-vc89-hccf-rq55 5.9

Hash collision in typelevel jawn

Impact

Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:

  • org.http4s :: http4s-play-json
  • org.typelevel :: jawn-ast (< 0.8.0)
  • org.typelevel :: jawn-play (discontinued)
  • org.typelevel :: jawn-rojoma (discontinued)
  • org.typelevel :: jawn-spray (discontinued)

Unaffected implementations include:

  • io.argonaut :: argonaut-jawn
  • io.circe :: circe-parser
  • org.typelevel :: jawn-ast (>= 0.8.0)
  • org.typelevel :: jawn-json4s (discontinued)
  • org.typelevel :: jawn-argonaut (discontinued)

Patches

jawn-parser-1.3.2 fixes the issue.

Workarounds

Override objectContext() to use a collision-safe collection. See the patch for an example in both SimpleFacade and MutableFacade.

References

Credits

  • @kag0, for the report and the patch

For more information

If you have any questions or comments about this advisory:

Record
GHSA-vc89-hccf-rq55
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-326, CWE-400
Updated
2026-11-02
NVD 5.9

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. jawn-parser-1.3.1 fixes this issue and users are advised to upgrade. For users unable to upgrade override objectContext() to use a collision-safe collection.

Record
CVE-2022-21653
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-400, CWE-326
Updated
2026-11-02
OSV 5.9

Hash collision in typelevel jawn

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. jawn-parser-1.3.1 fixes this issue and users are advised to upgrade. For users unable to upgrade override objectContext() to use a collision-safe collection.

Record
CVE-2022-21653
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVGHSA-vc89-hccf-rq55 5.9

Hash collision in typelevel jawn

Impact

Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:

  • org.http4s :: http4s-play-json
  • org.typelevel :: jawn-ast (< 0.8.0)
  • org.typelevel :: jawn-play (discontinued)
  • org.typelevel :: jawn-rojoma (discontinued)
  • org.typelevel :: jawn-spray (discontinued)

Unaffected implementations include:

  • io.argonaut :: argonaut-jawn
  • io.circe :: circe-parser
  • org.typelevel :: jawn-ast (>= 0.8.0)
  • org.typelevel :: jawn-json4s (discontinued)
  • org.typelevel :: jawn-argonaut (discontinued)

Patches

jawn-parser-1.3.2 fixes the issue.

Workarounds

Override objectContext() to use a collision-safe collection. See the patch for an example in both SimpleFacade and MutableFacade.

References

Credits

  • @kag0, for the report and the patch

For more information

If you have any questions or comments about this advisory:

Record
GHSA-vc89-hccf-rq55
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-326, CWE-400
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2022-21653 5.9

Jawn is an open source JSON parser. Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext() are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. jawn-parser-1.3.1 fixes this issue and users are advised to upgrade. For users unable to upgrade override objectContext() to use a collision-safe collection.

Record
UBUNTU-CVE-2022-21653
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2022:0011-1 No score

Security update for jawn

This update for jawn fixes the following issues:

  • CVE-2022-21653: DoS caused by a hash collision in SimpleFacade and MutableFacade (boo#1194358)
Record
openSUSE-SU-2022:0011-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:0045-1 No score

Security update for jaw

jawn was updated to fix:

  • CVE-2022-21653: DoS caused by a hash collision in SimpleFacade and MutableFacade (bsc#1194358)
Record
openSUSE-SU-2022:0045-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:0106-1 No score

Security update for jawn

This update for jawn fixes the following issues:

  • CVE-2022-21653: Fixed DoS caused by a hash collision in SimpleFacade and MutableFacade (bsc#1194358).
Record
openSUSE-SU-2022:0106-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11718-1 No score

jawn-ast-0.14.1-2.1 on GA media

These are all security issues fixed in the jawn-ast-0.14.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11718-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.typelevel:jawn-parser_0.25
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parserg
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_0.27
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_2.10
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_2.11
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_2.12
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_2.13
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_2.13.0-M5
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_2.13.0-RC1
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_2.13.0-RC2
Maven
 before 1.3.2
1.3.2
Show 36 moreShow less
Affected packages
PackageAffectedFixed
org.typelevel:jawn-parser_2.13.0-RC3
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_3
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_3.0.0-M1
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_3.0.0-M2
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_3.0.0-M3
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_3.0.0-RC1
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_3.0.0-RC2
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_3.0.0-RC3
Maven
 before 1.3.2
1.3.2
org.typelevel:jawn-parser_0.25
Maven
 All versions, plus listed versions
1.0.0
 None known
org.typelevel:jawn-parserg
Maven
 All versions None known
org.typelevel:jawn-parser_0.27
Maven
 All versions, plus listed versions
1.0.01.0.11.0.2
 None known
org.typelevel:jawn-parser_2.10
Maven
 All versions, plus listed versions
0.14.00.14.1
 None known
org.typelevel:jawn-parser_2.11
Maven
 All versions, plus listed versions
0.14.00.14.10.14.20.14.31.0.0-RC11.0.0-RC2
 None known
org.typelevel:jawn-parser_2.12
Maven
 before 1.3.2, plus listed versions
0.14.00.14.10.14.20.14.31.0.0
Show 13 moreShow less
1.0.0-RC11.0.0-RC21.0.0-RC31.0.0-RC41.0.11.0.21.0.31.1.01.1.11.1.21.2.01.3.01.3.1
1.3.2
org.typelevel:jawn-parser_2.13
Maven
 before 1.3.2, plus listed versions
0.14.20.14.31.0.01.0.0-RC11.0.0-RC2
Show 11 moreShow less
1.0.0-RC31.0.0-RC41.0.11.0.21.0.31.1.01.1.11.1.21.2.01.3.01.3.1
1.3.2
org.typelevel:jawn-parser_2.13.0-M5
Maven
 All versions, plus listed versions
0.14.00.14.1
 None known
org.typelevel:jawn-parser_2.13.0-RC1
Maven
 All versions, plus listed versions
0.14.2
 None known
org.typelevel:jawn-parser_2.13.0-RC2
Maven
 All versions, plus listed versions
0.14.2
 None known
org.typelevel:jawn-parser_2.13.0-RC3
Maven
 All versions, plus listed versions
0.14.2
 None known
org.typelevel:jawn-parser_3
Maven
 before 1.3.2, plus listed versions
1.1.21.2.01.3.01.3.1
1.3.2
org.typelevel:jawn-parser_3.0.0-M1
Maven
 All versions, plus listed versions
1.0.11.0.2
 None known
org.typelevel:jawn-parser_3.0.0-M2
Maven
 All versions, plus listed versions
1.0.21.0.3
 None known
org.typelevel:jawn-parser_3.0.0-M3
Maven
 All versions, plus listed versions
1.0.31.1.0
 None known
org.typelevel:jawn-parser_3.0.0-RC1
Maven
 All versions, plus listed versions
1.1.01.1.1
 None known
org.typelevel:jawn-parser_3.0.0-RC2
Maven
 All versions, plus listed versions
1.1.11.1.2
 None known
org.typelevel:jawn-parser_3.0.0-RC3
Maven
 All versions, plus listed versions
1.1.2
 None known
jawn
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
jawn
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
jawn
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
jawn
Ubuntu:25.10
 All versions, plus listed versions
0.11.1+really0.6.0-1
 None known
jawn
Ubuntu:26.10
 All versions, plus listed versions
0.11.1+really0.6.0-1build1
 None known
jawn
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.11.1+really0.6.0-10.11.1+really0.6.0-1build1
 None known
jawn
SUSE:Package Hub 15 SP3
 before 0.14.1-bp153.2.3.1
0.14.1-bp153.2.3.1
jawn
openSUSE:Leap 15.3
 before 0.14.1-bp153.2.3.1
0.14.1-bp153.2.3.1
jawn
SUSE:Package Hub 15 SP2
 before 0.14.1-bp152.2.3.1
0.14.1-bp152.2.3.1
jawn
openSUSE:Leap 15.3
 before 0.14.1-3.3.1
0.14.1-3.3.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21653 is a medium vulnerability (CVSS 5.9) in Typelevel Jawn, published January 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in org.typelevel:jawn-parser_0.25 1.3.2.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open