CyberRota Analysis
AI-GeneratedThe AsyncParser in Jawn, prior to version 1.7.0, is vulnerable to a denial-of-service attack due to its inefficient handling of JSON tokens delivered in small chunks, leading to excessive CPU resource consumption. Remote attackers can exploit this vulnerability by controlling untrusted JSON input, potentially disrupting applications that utilize the AsyncParser. Organizations using Jawn for JSON parsing should prioritize upgrading to version 1.7.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.