{"id":"CVE-2018-18855","aliases":["GHSA-ww3v-6xjf-jv28"],"status":"published","title":"Uncontrolled Resource Consumption in Spray JSON","description":"Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently \"open\" parsing state is kept on the stack.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2022-06-28T23:23:20Z","modified":"2025-09-30T19:18:45Z","fixes":[{"ecosystem":"Maven","package":"io.spray:spray-json_2.10","fixed_in":["1.3.5"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.11","fixed_in":["1.3.5"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.11.0-RC4","fixed_in":["1.3.5"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.12","fixed_in":["1.3.5"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-M3","fixed_in":["1.3.5"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-M5","fixed_in":["1.3.5"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-RC1","fixed_in":["1.3.5"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-RC2","fixed_in":["1.3.5"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.13.0-M2","fixed_in":["1.3.5"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.13.0-M4","fixed_in":["1.3.5"],"sources":["ghsa"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.13.0-M5","fixed_in":["1.3.5"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.spray:spray-json_2.9.3","fixed_in":["1.3.5"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.11.0-RC4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-M3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-M5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-RC1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-RC2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.13.0-M2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.13.0-M4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.13.0-M5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.spray:spray-json_2.9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.2.5","1.2.6","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.2.6","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.11.0-RC4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.6"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.3.2","1.3.3","1.3.4"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-M3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-M5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-RC1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.12.0-RC2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.13.0-M2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.13.0-M4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.13.0-M5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.3.4"]},{"source":"osv","ecosystem":"Maven","package":"io.spray:spray-json_2.9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5","1.2.6"]}],"references":[{"url":"https://github.com/spray/spray-json/pull/284","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-IOSPRAY-72601","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ww3v-6xjf-jv28"},{"url":"https://github.com/spray/spray-json","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-ww3v-6xjf-jv28","title":"Uncontrolled Resource Consumption in Spray JSON","description":"Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently \"open\" parsing state is kept on the stack.","status":"published","published":"2022-06-28T23:23:20Z","modified":"2025-09-30T19:11:49Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:59.83883Z"}],"osv":[{"id":"GHSA-ww3v-6xjf-jv28","title":"Uncontrolled Resource Consumption in Spray JSON","description":"Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently \"open\" parsing state is kept on the stack.","status":"published","published":"2022-06-28T23:23:20Z","modified":"2025-09-30T19:18:45.945287Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:59.131095Z"}]}}