{"id":"CVE-2026-61814","aliases":["DEBIAN-CVE-2026-61814","EUVD-2026-85551","GHSA-w4cm-gvhj-cgw6","SUSE-SU-2026:4407-1","UBUNTU-CVE-2026-61814"],"status":"published","title":"Jawn: Quadratic parsing effort in AsyncParser","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0075,"percentile":0.55472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2026-09-23T18:39:01Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.12","fixed_in":["1.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.13","fixed_in":["1.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.typelevel:jawn-parser_3","fixed_in":["1.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"jawn","fixed_in":["0.14.1-150200.3.6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.6.0"},{"fixed":"1.7.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.6.0"},{"fixed":"1.7.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.typelevel:jawn-parser_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.6.0"},{"fixed":"1.7.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}],"versions":["0.14.0","0.14.1","0.14.2","0.14.3","1.0.0","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.0-RC4","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.5.0","1.5.1","1.6.0"]},{"source":"osv","ecosystem":"Maven","package":"org.typelevel:jawn-parser_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}],"versions":["0.14.2","0.14.3","1.0.0","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.0-RC4","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.5.0","1.5.1","1.6.0"]},{"source":"osv","ecosystem":"Maven","package":"org.typelevel:jawn-parser_3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}],"versions":["1.1.2","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.5.0","1.5.1","1.6.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.1+really0.6.0-1","0.11.1+really0.6.0-1build1"]}],"products":[{"vendor":"org.typelevel","product":"jawn-parser_2.12"},{"vendor":"org.typelevel","product":"jawn-parser_2.13"},{"vendor":"org.typelevel","product":"jawn-parser_3"},{"vendor":"typelevel","product":"jawn"}],"references":[{"url":"https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/typelevel/jawn/releases/tag/v1.7.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/advisories/GHSA-w4cm-gvhj-cgw6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61814.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61814","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-61814","tags":["advisory"]},{"url":"https://github.com/typelevel/jawn","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264407-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282548","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61814","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-61814","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61814","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-61814","title":"Jawn: Quadratic parsing effort in AsyncParser","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T18:39:01.067Z","modified":"2026-09-23T19:41:40.864Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:19:53.4444Z"}],"euvd":[{"id":"EUVD-2026-85551","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T18:39:01Z","modified":"2026-09-23T19:41:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:59.820483Z"}],"ghsa":[{"id":"GHSA-w4cm-gvhj-cgw6","title":"Jawn: Quadratic parsing effort in AsyncParser","description":"`AsyncParser` can be forced to perform O(n^2) work on the length of the input.  When a single JSON token arrives across many small chunks, each `absorb` call rescans the incomplete token from the start.\n\n### Impact\n\nDenial of service via CPU exhaustion when parsing untrusted JSON.\n\nPreconditions:\n- Application uses `AsyncParser`\n- Attacker can send large tokens with control over chunk sizes.\n\n### Patches\n\nFixed in jawn-parser-1.7.0.\n\n### Workarounds\n\nIf you can't upgrade immediately:\n- Use the synchronous `Parser`.\n- Buffer incoming bytes into larger chunks before calling `absorb`","status":"published","published":"2026-09-23T21:23:58Z","modified":"2026-09-23T21:23:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:41:20.575159Z"}],"nvd":[{"id":"CVE-2026-61814","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T19:17:32.97Z","modified":"2026-09-30T17:32:07.107Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-61814","title":"Jawn: Quadratic parsing effort in AsyncParser","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T18:39:01.067Z","modified":"2026-10-28T02:31:00.203501961Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-61814","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T19:17:32.97Z","modified":"2026-10-01T08:47:27.949099705Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-w4cm-gvhj-cgw6","title":"Jawn: Quadratic parsing effort in AsyncParser","description":"`AsyncParser` can be forced to perform O(n^2) work on the length of the input.  When a single JSON token arrives across many small chunks, each `absorb` call rescans the incomplete token from the start.\n\n### Impact\n\nDenial of service via CPU exhaustion when parsing untrusted JSON.\n\nPreconditions:\n- Application uses `AsyncParser`\n- Attacker can send large tokens with control over chunk sizes.\n\n### Patches\n\nFixed in jawn-parser-1.7.0.\n\n### Workarounds\n\nIf you can't upgrade immediately:\n- Use the synchronous `Parser`.\n- Buffer incoming bytes into larger chunks before calling `absorb`","status":"published","published":"2026-09-23T21:23:58Z","modified":"2026-09-23T21:45:08.084551628Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2026-61814","description":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.","status":"published","published":"2026-09-23T19:17:00Z","modified":"2026-10-17T12:57:17.021254338Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"SUSE-SU-2026:4407-1","title":"Security update for jawn","description":"This update for jawn fixes the following issue:\n\n- CVE-2026-61814: quadratic rescan complexity in AsyncParser can cause excessive CPU resource exhaustion (bsc#1282548).\n","status":"published","published":"2026-09-30T14:24:18Z","modified":"2026-10-01T11:15:05.339647845Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}