CVE-2026-108602

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602

The software Helicone (versions through v2025.08.21-1 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the Jawn webhook sender component. The root cause allows authenticated organization users to reach internal services by providing hostnames that resolve to private addresses or utilize...

EUVD-2026-96428

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602: Server-Side Request Forgery (SSRF)

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

PT-2026-109747

Name of the Vulnerable Software and Affected Versions Helicone versions prior to 2025.08.21-2 Description A server-side request forgery SSRF issue exists in the Jawn webhook sender. This allows authenticated organization users to access internal services by utilizing hostnames that resolve to...

SUSE SLES15 Security Update : jawn (SUSE-SU-2026:4407-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4407-1 advisory. This update for jawn fixes the following issue: - CVE-2026-61814: quadratic rescan complexity in AsyncParser can cause excessive CPU resource exhaustio...

Security update for jawn

This update for jawn fixes the following issue: CVE-2026-61814: quadratic rescan complexity in AsyncParser can cause excessive CPU resource exhaustion bsc1282548. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4407-1 Security update for jawn

This update for jawn fixes the following issue: - CVE-2026-61814: quadratic rescan complexity in AsyncParser can cause excessive CPU resource exhaustion bsc1282548...

Linux Distros Unpatched Vulnerability : CVE-2026-61814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks...

Linux Distros Unpatched Vulnerability : CVE-2026-59990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a...

SUSE CVE-2026-59990

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting...

SUSE CVE-2026-61814

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-checkpoint-git_3 (>=0.3.0, <=0.5.7) +1175 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_3 (>=1.1.2, <=1.6.0)

org.typelevel:jawn-parser3 MAVEN version =1.1.2, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.4.0 and more Source cves: CVE-2026-61814 Source advisory: OSV:GHSA-W4CM-GVHJ-CGW6...

com.github.fsanaulla:chronicler-ahc-io_2.13 (>=0.6.5, <=0.7.0), com.github.fsanaulla:chronicler-ahc-management_2.13 (>=0.6.5, <=0.7.0) +32 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_2.13 (0.14.3)

org.typelevel:jawn-parser2.13 MAVEN version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.13 and may be impacted: - com.github.fsanaulla:chronicler-ahc-io2.13 =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5,...

ai.mantik:bridge-protocol_2.13 (>=0.4.0-rc1, <=0.4.0), ai.mantik:componently_2.13 (>=0.4.0-rc1, <=0.4.0) +1719 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_2.13 (>=1.0.0-rc1, <=1.6.0)

org.typelevel:jawn-parser2.13 MAVEN version =1.0.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0 and more Source cves: CVE-2026-61814 Source advisory:...

com.github.fsanaulla:chronicler-ahc-io_2.12 (>=0.6.5, <=0.7.0), com.github.fsanaulla:chronicler-ahc-management_2.12 (>=0.6.5, <=0.7.0) +37 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_2.12 (0.14.3)

org.typelevel:jawn-parser2.12 MAVEN version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.12 and may be impacted: - com.github.fsanaulla:chronicler-ahc-io2.12 =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5, =0.6.5,...

ai.eto:rikai_2.12 (>=0.0.3, <=0.1.7), black.door:jose-2.12.8-json-circe-2.12.8_2.12 (0.3.0-m1) +496 more potentially affected by CVE-2026-61814 via org.typelevel:jawn-parser_2.12 (0.14.2)

org.typelevel:jawn-parser2.12 MAVEN version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parser2.12 and may be impacted: - ai.eto:rikai2.12 =0.0.3, =0.2.4, =0.3.0, =4.1.0, =4.1.0, =4.1.0, =0.6.0, =0.6.0, =0.6.0, =0.0.1,...

Jawn: Quadratic parsing effort in AsyncParser

AsyncParser can be forced to perform On^2 work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start. Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application...