Uncontrolled Resource Consumption in spray-json when parsing decimal digit fields

2018-11-0917:42:26

Google

osv.dev

0.002 Low

EPSS

Percentile

59.9%

JSON

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits.

CPENameOperatorVersion
io.spray:spray-json_2.10eq1.3.4
io.spray:spray-json_2.10eq1.2.5
io.spray:spray-json_2.12eq1.3.3
io.spray:spray-json_2.12eq1.3.2
io.spray:spray-json_2.11eq1.3.3
io.spray:spray-json_2.11eq1.3.2
io.spray:spray-json_2.10eq1.3.1
io.spray:spray-json_2.10eq1.3.2
io.spray:spray-json_2.10eq1.3.3
io.spray:spray-json_2.12eq1.3.4

Name	Operator	Version
io.spray:spray-json_2.10	eq	1.3.4
io.spray:spray-json_2.10	eq	1.2.5
io.spray:spray-json_2.12	eq	1.3.3
io.spray:spray-json_2.12	eq	1.3.2
io.spray:spray-json_2.11	eq	1.3.3
io.spray:spray-json_2.11	eq	1.3.2
io.spray:spray-json_2.10	eq	1.3.1
io.spray:spray-json_2.10	eq	1.3.2
io.spray:spray-json_2.10	eq	1.3.3
io.spray:spray-json_2.12	eq	1.3.4