CVE-2026-61814CWE-400CWE-407denial-of-service

CVE-2026-61814

High · published September 23, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00567 · 46.3th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-407 · Inefficient Algorithmic Complexity
Published
2026-09-23T23:17Z
References (3)
https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b · [email protected]https://github.com/typelevel/jawn/releases/tag/v1.7.0 · [email protected]https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6 · [email protected]
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved — → 1%
    epss
  • 23 SEP 18:39Z
    Jawn: Quadratic parsing effort in AsyncParser
    cvelistv5