Allocation of Resources Without Limits or Throttling Affecting org.typelevel:jawn-parser_2.13 package, versions [,1.7.0)

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Parser and AsyncParser recursive JSON parsing paths in parser/shared/src/main/scala/jawn/Parser.scala and parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker can exhaust JVM heap and trigger java.lang.OutOfMemoryError by supplying JSON with deeply nested arrays or objects to any jawn-backed parse method. The vulnerable code recurses through nested containers without a nesting-depth limit, so a remote request carrying adversarial JSON can drive unbounded stack/list growth during parse. In Scala this failure is typically fatal and can crash the service or abort request handling rather than returning a recoverable parse error.

Workarounds

• Enforce an input size limit small enough that the resulting context stack cannot exhaust heap, such as http4s EntityLimiter, to reduce the chance that deeply nested JSON can drive JVM heap exhaustion.
• Pre-scan untrusted input and reject documents whose maximum delimiter nesting exceeds a threshold before handing them to jawn, to block adversarially deep arrays or objects from reaching the parser.

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• Maintainer's Advisory