HSEC-2026-0007
Denial of Service and Memory Exhaustion in aeson
Denial of Service and Memory Exhaustion in aeson
A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the aeson package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads.
The vulnerability exists in aeson's withBoundedScientific_ function (located in src/Data/Aeson/Types/FromJSON.hs). The exponent bounds check only rejects large positive exponents (exp10 > 1024) but fails to reject arbitrarily large negative exponents.
When an attacker sends a JSON number with a massive negative exponent (e.g., 1e-999999999), the value bypasses the check and flows into realToFrac, which computes fromRational . toRational. For such a large negative exponent, toRational produces a GMP Integer with approximately 1 billion decimal digits, causing immediate and severe memory exhaustion.
Affected FromJSON instances:
Fixed a(includingCenti,Pico,Nano, etc.)NominalDiffTimeDiffTime
Resolution
The issue was resolved by introducing proper bounds checks:
aesonnow applies an absolute bounds check to both positive and negative exponents (abs exp10 > 1024).
The fix first shipped in aeson-2.3.0.0, and have been backported to the previous release series as aeson-2.2.5.1.
Users are strongly advised to update to the patched versions:
aeson-2.2.5.1or later
Acknowledgements
The vulnerabilities were reported Nathan Walsh, and patched by Li-yao Xia.
What each source reports
OSV No score
Denial of Service and Memory Exhaustion in aeson
Denial of Service and Memory Exhaustion in aeson
A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the aeson package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying maliciously crafted JSON payloads.
The vulnerability exists in aeson's withBoundedScientific_ function (located in src/Data/Aeson/Types/FromJSON.hs). The exponent bounds check only rejects large positive exponents (exp10 > 1024) but fails to reject arbitrarily large negative exponents.
When an attacker sends a JSON number with a massive negative exponent (e.g., 1e-999999999), the value bypasses the check and flows into realToFrac, which computes fromRational . toRational. For such a large negative exponent, toRational produces a GMP Integer with approximately 1 billion decimal digits, causing immediate and severe memory exhaustion.
Affected FromJSON instances:
Fixed a(includingCenti,Pico,Nano, etc.)NominalDiffTimeDiffTime
Resolution
The issue was resolved by introducing proper bounds checks:
aesonnow applies an absolute bounds check to both positive and negative exponents (abs exp10 > 1024).
The fix first shipped in aeson-2.3.0.0, and have been backported to the previous release series as aeson-2.2.5.1.
Users are strongly advised to update to the patched versions:
aeson-2.2.5.1or later
Acknowledgements
The vulnerabilities were reported Nathan Walsh, and patched by Li-yao Xia.
- Record
HSEC-2026-0007- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aesonHackage |
0.12.0.0 up to 2.2.5.1, plus listed versions 1.0.0.01.0.1.01.0.2.01.0.2.11.1.0.0 Show 43 moreShow less1.1.1.01.1.2.01.2.0.01.2.1.01.2.2.01.2.3.01.2.4.01.3.0.01.3.1.01.3.1.11.4.0.01.4.1.01.4.2.01.4.3.01.4.4.01.4.5.01.4.6.01.4.7.01.4.7.11.5.0.01.5.1.01.5.2.01.5.3.01.5.4.01.5.4.11.5.5.01.5.5.11.5.6.02.0.0.02.0.1.02.0.2.02.0.3.02.1.0.02.1.1.02.1.2.02.1.2.12.2.0.02.2.1.02.2.2.02.2.3.02.2.4.02.2.4.12.2.5.0 |
2.2.5.1 |
text-iso8601Hackage |
0.1 up to 0.1.1.2, plus listed versions 0.1.10.1.1.1 |
0.1.1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
HSEC-2026-0007 is a vulnerability with no CVSS score yet in aeson, published May 22, 2026. No source lists public exploit code. Fixed in aeson 2.2.5.1.