{"id":"CVE-2026-59990","aliases":["DEBIAN-CVE-2026-59990","EUVD-2026-85554","GHSA-cc4v-rvgp-2pf3","UBUNTU-CVE-2026-59990"],"status":"published","title":"Jawn: Uncontrolled nesting depth in JSON parser","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00615,"percentile":0.4997,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-09-23T18:41:12Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.12","fixed_in":["1.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.13","fixed_in":["1.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.typelevel:jawn-parser_3","fixed_in":["1.7.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.6.0"},{"fixed":"1.7.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.6.0"},{"fixed":"1.7.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.typelevel:jawn-parser_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.6.0"},{"fixed":"1.7.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}],"versions":["0.14.0","0.14.1","0.14.2","0.14.3","1.0.0","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.0-RC4","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.5.0","1.5.1","1.6.0"]},{"source":"osv","ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}],"versions":["0.14.2","0.14.3","1.0.0","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.0-RC4","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.5.0","1.5.1","1.6.0"]},{"source":"osv","ecosystem":"Maven","package":"org.typelevel:jawn-parser_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}],"versions":["1.1.2","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.5.0","1.5.1","1.6.0"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1","0.11.1+really0.6.0-1build1"]}],"products":[{"vendor":"typelevel","product":"jawn"}],"references":[{"url":"https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/typelevel/jawn/releases/tag/v1.7.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/advisories/GHSA-cc4v-rvgp-2pf3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59990.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59990","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59990","tags":["advisory"]},{"url":"https://github.com/typelevel/jawn","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-59990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59990","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59990","title":"Jawn: Uncontrolled nesting depth in JSON parser","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T18:41:12.073Z","modified":"2026-09-23T19:27:58.498Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-85554","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T18:41:12Z","modified":"2026-09-23T19:27:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:00.170339Z"}],"ghsa":[{"id":"GHSA-cc4v-rvgp-2pf3","title":"Jawn: Uncontrolled nesting depth in JSON parser","description":"The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input.\n\n### Impact\n\nA remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger `java.lang.OutOfMemoryError`.  This is treated by Scala as a fatal error and not typically handled by `scala.util.Try` or `cats.effect.IO`.\n\n### Patches\n\nVersion `1.6.1` introduces a configurable nesting-depth limit (`Parser#maxDepth`, default `4096`).  Inputs deeper than the limit fail with a recoverable `ParseException` instead of exhausting heap.\n\nUsers who require deeper nesting may override `maxDepth` on a `Parser` subclass.\n\n### Workarounds\n\n- Enforce an input size limit small enough that the resulting context stack cannot exhaust heap, (e.g. http4s `EntityLimiter`).\n- Pre-scan untrusted input and reject documents whose maximum delimiter nesting exceeds a threshold before handing them to jawn.","status":"published","published":"2026-09-23T21:23:54Z","modified":"2026-09-23T21:23:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:20.575159Z"}],"nvd":[{"id":"CVE-2026-59990","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T19:17:32.637Z","modified":"2026-09-30T17:32:07.107Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-59990","title":"Jawn: Uncontrolled nesting depth in JSON parser","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T18:41:12.073Z","modified":"2026-10-28T02:30:53.500213054Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-59990","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T19:17:32.637Z","modified":"2026-10-01T08:47:42.112030875Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-cc4v-rvgp-2pf3","title":"Jawn: Uncontrolled nesting depth in JSON parser","description":"The Jawn parser before 1.6.1 is vulnerable to a denial of service attack via untrusted input.\n\n### Impact\n\nA remote attacker who can submit JSON to any jawn-backed parse method can exhaust JVM heap and trigger `java.lang.OutOfMemoryError`.  This is treated by Scala as a fatal error and not typically handled by `scala.util.Try` or `cats.effect.IO`.\n\n### Patches\n\nVersion `1.6.1` introduces a configurable nesting-depth limit (`Parser#maxDepth`, default `4096`).  Inputs deeper than the limit fail with a recoverable `ParseException` instead of exhausting heap.\n\nUsers who require deeper nesting may override `maxDepth` on a `Parser` subclass.\n\n### Workarounds\n\n- Enforce an input size limit small enough that the resulting context stack cannot exhaust heap, (e.g. http4s `EntityLimiter`).\n- Pre-scan untrusted input and reject documents whose maximum delimiter nesting exceeds a threshold before handing them to jawn.","status":"published","published":"2026-09-23T21:23:54Z","modified":"2026-09-23T21:30:04.437683237Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"UBUNTU-CVE-2026-59990","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T19:17:00Z","modified":"2026-10-17T12:56:00.888821127Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"}]}}