CyberRota Analysis
AI-GeneratedThe Jawn JSON parser prior to version 1.7.0 is vulnerable to denial of service due to its lack of depth limits on JSON array and object nesting, which can lead to excessive memory consumption and a java.lang.OutOfMemoryError. This vulnerability can be exploited by remote attackers submitting untrusted JSON, impacting applications that rely on the parser. Organizations using affected versions of Jawn should prioritize upgrading to version 1.7.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0.